Extract from PowerShell script showing how Azure App Gateway path-based routing rules can used to protect internal API's on API Management

apimappgw.ps1

# Get existing Application Gateway config
$appgw = Get-AzApplicationGateway -ResourceGroupName $resGroupName -Name $appgwName
$listener = Get-AzApplicationGatewayHttpListener -Name "apim-gw-listener01" -ApplicationGateway $appgw
$sinkpool = Get-AzApplicationGatewayBackendAddressPool -ApplicationGateway $appgw -Name "sinkpool"
$pool = Get-AzApplicationGatewayBackendAddressPool -ApplicationGateway $appgw -Name "apimbackend"
$poolSettings = Get-AzApplicationGatewayBackendHttpSettings -ApplicationGateway $appgw -Name "apim-gw-poolsetting"

# Add external path rule + map
$pathRule = New-AzApplicationGatewayPathRuleConfig -Name "external" -Paths "/external/*" -BackendAddressPool $pool -BackendHttpSettings $poolSettings
$appgw = Add-AzApplicationGatewayUrlPathMapConfig -ApplicationGateway $appgw -Name "external-urlpathmapconfig" -PathRules $pathRule -DefaultBackendAddressPool $sinkpool -DefaultBackendHttpSettings $poolSettings
$appgw = Set-AzApplicationGateway -ApplicationGateway $appgw

# Add external path-based routing rule
# (completed separately from adding the path rule + map as it appears these need to be pre-configured bfore the routing rule is added)
$pathmap = Get-AzApplicationGatewayUrlPathMapConfig -ApplicationGateway $appgw -Name "external-urlpathmapconfig"
$appgw = Add-AzApplicationGatewayRequestRoutingRule -ApplicationGateway $appgw -Name "apim-gw-external-rule01" -RuleType PathBasedRouting -HttpListener $listener -BackendAddressPool $Pool -BackendHttpSettings $poolSettings -UrlPathMap $pathMap
$appgw = Set-AzApplicationGateway -ApplicationGateway $appgw