Azure API管理在API端点级别限制多个呼叫者IP地址API

Question

我想在Azure APIM策略级别限制一些IP。

我在链接下面走了; https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#RestrictCallerIPs

Azure API Management Restrict multiple caller IP Address

但不确定如何使用policy scope对API端点级别执行此操作

我在policy.xml中有以下代码：

<policies>
    <inbound>
        <base />
        <!-- statements to be applied to the request go here -->
        <authentication-certificate thumbprint="@((string)context.Variables[&quot;ClientCertificateThumbprint&quot;])" />
        <rate-limit-by-key calls="100" renewal-period="60" counter-key="@(context.Request.Headers.GetValueOrDefault(&quot;Ocp-Apim-Subscription-Key&quot;))" />        
        <cors>
            <allowed-origins>
                <origin>*</origin>
            </allowed-origins>
            <allowed-methods preflight-result-max-age="600">
                <method>*</method>
            </allowed-methods>
            <allowed-headers>
                <header>*</header>
            </allowed-headers>
            <expose-headers>
                <header>*</header>
            </expose-headers>
        </cors>
        <ip-filter action="allow">
          <address>55.11.187.20</address>
          <address-range from="186.168.95.0" to="186.168.95.20" />
        </ip-filter>
    </inbound>
    <backend>
        <base />

        <!-- statements to be applied before the request is forwarded to 
         the backend service go here -->
    </backend>
    <outbound>
        <base />

        <!-- statements to be applied to the response go here -->
    </outbound>
    <on-error>
        <base />
        <!-- statements to be applied if there is an error condition go here -->
    </on-error>
</policies

>

Answer 1

1. 导航到Azure门户，您的APIM服务，API。
2. 单击要应用IP过滤器的API
3. 在“入站处理”部分中，单击“添加策略”，然后选择“IP过滤器”。

Answer 2

使用高级策略中的控制流，您可以将范围更改为API端点级别（操作）以限制IP地址，如下所示

<choose>
      <when condition="@(context.Operation.Id.Equals(&quot;StatusGet&quot;))">
        <ip-filter action="allow">
          <address>55.11.187.20</address>
           <address-range from="186.168.95.0" to="186.168.95.20" />
        </ip-filter>
      </when>
    </choose>
</inbound>

参考：https://docs.microsoft.com/en-us/azure/api-management/api-management-advanced-policies