Outbound IP address Azure API Management

Question

Scenario: I have Pay-As-You-Go instance of Azure API Management created. In that, as APIs, I have imported Azure Functions App. Azure Functions app is on Consumption Plan as well. These azure functions are calling some external APIs and getting data. I return data as is from these functions.

Issue: To get data from external APIs, I need to get my IP address whitelisted. My calling pattern is APIM => Azure Function => External API. I am hitting APIM endpoint from my UI to get data. I have not exposed azure functions endpoint to UI. Issue is what IP should be whitelisted to get the data ?

Options Tried:

1. I got the APIM virtual address(public) whitelisted, but that didn't work.
2. I added logs to my each function to log outbound IP address (using ipconfig.me). This is giving me different IP address then that of APIM public IP.

My confusion is, if I have imported these functions to APIM, then my outbound IP address should be of APIM and not of functions, right ? or my understanding is wrong here ?

It will be really helpful if someone can help with this scenario. We need to get our IP whitelisted so that we can get data. For that changes to infra can be done, even if we need to switch to premium plans.

Answer 1

In your case APIM works as a gateway to your system, so you would use outbound IP address for APIM for IP restrictions configured on Azure Functions level. This would secure access to Functions and limit it to only APIM.

As you need to secure External API, which is accessed via Azure Functions, you need to check outbound IP for your App Service Plan(whether it's Consumption or not). The scenario you were trying would work only if outbound traffic is sent via some kind of gateway (see - https://docs.microsoft.com/en-us/azure/azure-functions/functions-how-to-use-nat-gateway )

Without a gateway, outbound IP can be checked with the following commands:

az functionapp show --resource-group <GROUP_NAME> --name <APP_NAME> --query outboundIpAddresses --output tsv
az functionapp show --resource-group <GROUP_NAME> --name <APP_NAME> --query possibleOutboundIpAddresses --output tsv