Wallarm Connector for Azure API Management¶

This guide describes how to secure your APIs managed by Azure API Management (APIM) using the Wallarm connector.

Overview¶

To use Wallarm as a connector for Azure APIM, you need to deploy the Wallarm Node externally and apply Wallarm policy fragments in Azure to route traffic to the Node for analysis.

The Wallarm connector for Azure APIM supports the synchronous and asynchronous traffic analysis:

Use cases¶

This solution is recommended for securing APIs managed by the Azure APIM service.

Limitations¶

• Custom blocking code configuration is not supported.

  All blocked malicious traffic is returned with status code 403 by default. You can customize the block page content, but not the response code itself.

• Rate limiting by Wallarm rules is not supported.

  Rate limiting cannot be enforced on the Wallarm side for this connector. If rate limiting is required, use Azure APIM's built-in policies.

• Multitenancy is not supported.

  All protected APIs are managed under a single Wallarm account; separating protection across multiple accounts for different infrastructures or environments is not yet supported.

• Attacks in query parameters and URI are registered 3 times.

  This is because the Azure Application Gateway adds the X-ORIGINAL-URL and X-WAWS-UNENCODED-URL headers, which fully reflect the original URI including the attack pattern. As a result, a single malicious parameter or URI path generates three detections:

  • In the query parameter or URI path itself
  • In the X-ORIGINAL-URL header
  • In the X-WAWS-UNENCODED-URL header

Requirements¶

Before deployment, ensure the following prerequisites are met:

• Familiarity with Azure API Management.

• APIs are published via Azure API Management.

• A user account with one of the following roles in Azure APIM:

  • API Management Workspace Contributor - for managing policy fragments within a workspace.
  • API Management Service Contributor - for global configuration across the entire APIM instance.

• Access to the Administrator account in Wallarm Console for the US Cloud or EU Cloud.

• Native Node version 0.18.0 or higher.

• A valid trusted SSL/TLS certificate for the Wallarm Node domain (self-signed certificates are not supported).

Deployment¶

1. Deploy a Wallarm Node¶

The Wallarm Node is a core component of the Wallarm platform that you need to deploy. It inspects incoming traffic, detects malicious activities, and can be configured to mitigate threats.

You can deploy it either hosted by Wallarm or in your own infrastructure, depending on the level of control you require.

2. Create named values in Azure¶

Define the following named values in Azure API Management to reference them from policies:

The example below shows how the named values look in the Azure Portal:

3. Obtain and deploy Wallarm policy fragments¶

The Azure API Management connector package includes 4 XML files:

• Synchronous mode:

  • wallarm-inline-request.xml
  • wallarm-inline-response.xml

• Asynchronous mode:

  • wallarm-out-of-band-request.xml
  • wallarm-out-of-band-response.xml

Each mode requires 2 fragments: one for requests (inbound) and one for responses (outbound).

The steps below use the Azure Portal UI, but you can also deploy policy fragments with Terraform or ARM templates.

1. Contact sales@wallarm.com to get the policy fragments.

2. Extract the policy archive.

3. Navigate to Azure Portal → API Management service → APIs → Policy fragments → Create.

4. Create a request policy fragment using wallarm-inline-request.xml for synchronous mode or wallarm-out-of-band-request.xml for asynchronous mode.

   You can name the fragment consistently with the file: wallarm-inline-request or wallarm-out-of-band-request.

   Example of a request policy fragment in Azure Portal:

   

5. Create a response policy fragment using wallarm-inline-response.xml for synchronous mode or wallarm-out-of-band-response.xml for asynchronous mode.

   You can name the fragment consistently with the file: wallarm-inline-response or wallarm-out-of-band-response.

   Example of a response response fragment in Azure Portal:

   

4. Apply Wallarm policy fragments to APIs¶

You can attach Wallarm fragments globally to all APIs or individually to specific APIs or operations.

Insert fragments inside your existing policy to preserve the current flow.

Globally (all APIs)¶

1. Navigate to Azure Portal → APIs → All APIs.

2. Under Inbound processing and Outbound processing, add the fragments, for example:

<policies>
    <inbound>
        <include-fragment fragment-id="wallarm-sync-request" />
    </inbound>
    <backend>
        <forward-request />
    </backend>
    <outbound>
        <include-fragment fragment-id="wallarm-sync-response" />
    </outbound>
    <on-error />
</policies>

<policies>
    <inbound>
        <include-fragment fragment-id="wallarm-async-request" />
    </inbound>
    <backend>
        <forward-request />
    </backend>
    <outbound>
        <include-fragment fragment-id="wallarm-async-response" />
    </outbound>
    <on-error />
</policies>

Per API or operation¶

To apply the created fragments to individual APIs or operations:

1. Navigate to Azure Portal → APIs → select API → All operations or specific operation.

2. Under Inbound processing and Outbound processing, add the fragments before <base/> so inspection happens prior to routing, for example:

<policies>
    <inbound>
        <include-fragment fragment-id="wallarm-sync-request" />
        <base />
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <include-fragment fragment-id="wallarm-sync-response" />
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

<policies>
    <inbound>
        <include-fragment fragment-id="wallarm-async-request" />
        <base />
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <include-fragment fragment-id="wallarm-async-response" />
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

Example of per-API application in Azure Portal:

Testing¶

Test the deployed policy fragments with both legitimate and malicious traffic.

Legitimate traffic¶

1. In Azure Portal, go to your API → Test → select an operation → enter valid parameters → Trace:

   

2. Review the HTTP response trace - you should see the inbound policy request-forwarder:

   

3. In Wallarm Console → API Sessions, verify that the legitimate request is displayed:

   

Malicious traffic¶

1. Send a request with a test SQLi attack by adding the query parameter x='+OR+1=1:

   

   • Synchronous mode with blocking enabled: the request is blocked with 403.
   • Synchronous mode (monitoring): request reaches the API and is logged in Wallarm Console.
   • Asynchronous mode: request reaches the API and is logged in Wallarm Console.

2. In Wallarm Console → API Sessions, verify that the malicious request is logged:

   

3. In Wallarm Console → Attacks, confirm that the attack is listed:

   

   The attack will appear 3 times due to APIM headers.

Block page customization¶

If the Node is deployed in synchronous mode with blocking enabled, you can customize the block page returned for blocked malicious requests:

1. Navigate to Azure Portal → API Management → APIs → Policy fragments.

2. Open the wallarm-sync-request fragment and edit the <set-body> section:

Upgrading the policies¶

To upgrade the deployed Wallarm policies to a newer version:

1. Download the updated Wallarm policy package and create new fragments using the updated XML files, as described in Step 3.

2. Update your API policies to reference the new fragment names, as described in Step 4.

3. Test both legitimate and malicious traffic to confirm correct behavior.

Policy upgrades may require a Wallarm Node upgrade, especially for major version updates. See the Native Node changelog for the self-hosted Node release notes. Regular node updates are recommended to avoid deprecation and simplify future upgrades.

Uninstalling the policies¶

To remove the Wallarm connector from Azure API Management:

1. Navigate to Azure Portal → API Management service → APIs → your API.

2. Remove the inbound and outbound <include-fragment> lines referencing Wallarm fragments.

3. Remove the Wallarm policy fragments from Policy fragments.

4. Remove the WallarmNodeUrl and WallarmIgnoreErrors named values if they are no longer needed.

Was this page helpful?

How can we improve this article? (Optional)

Information is unclear or confusing

Insufficient information

Outdated or incorrect information

0/240

Send