API Management & Microservice in different subscription

Question

I am developing a microservice which will run on AKS in production. I have to expose these service APIs through API management however challenge here is that API management is not available in same subscription. In that case, do i need to expose microservices publicly so API management can access it or vNet pairing between multiple subscriptions will help & microservice will be accessible in API management without exposing publicly.

Answer 1

You can add backend and APIM to different VNET and try to setup peering, that should work. Alternatively expose endpoints publicly, but with mutual certificate authentication.

Answer 2

VNET Peering and mutual certificate authentication are solutions as mentioned by Vitaliy.

Another possible solution is the APIM Self-Hosted Gateway. This is a new feature recently added to APIM. The new self-hosted gateway can be deployed to AKS cluster which might be a possible solution to your issue. This way you will need only to expose the APIM API endpoints.

https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview https://learn.microsoft.com/en-us/azure/api-management/how-to-deploy-self-hosted-gateway-kubernetes