This is a question that arises with some frequency. This question is usually driven by a security compliance constraint that is placed on the customer Apigee team. The reason for wanting to separate components into different network segments needs to be understood.
In case you want a quick answer, there is no need to do so. Apigee is best installed in its entirety behind the DMZ.
A DMZ is used to protect the rest of the network from a node that has been exploited. A common exploit is when an open port has been sent a binary payload that enables an assailant to take control of that node. The compromised node can then be used to compromise other nodes in the same network segment. These additional nodes are considered to be part of the blast radius of nodes that are accessible to the compromised node. A DMZ limits the nodes that can be compromised in this way.
This brings us to how Apigee is deployed. The primary concern that drives the deployment of an Apigee instance in a DMZ is to protect the rest of the network should an Apigee node be compromised by a binary exploit.
Apigee operates on L7 of the OSGI network model. L7 is the application layer that only processes payloads and data by first parsing text and then forwarding that parsed text for further processing. It should be noted that due to the specificity of parsing a payload for text the L7 layer is not receptive to a binary exploit. A binary exploit would be suitable machine code that can bypass port protection to directly executing code that takes advantage of the protocol running on the port. As such, there is no L7 binary exploit that can take control of an Apigee node.
It should be noted that exploits on L7 all require text parsing which must be further processed before anything can be executed. Javascript is not a binary payload but instead must be run through an interpreter or directly interpreted by a policy. Similarly a SQL injection attack or some recursive XML payload is not a binary payload but instead must also be parsed and processed. Apigee’s design builds in very good protections against L7 attacks. These protections apply not just to preventing compromise on any Apigee nodes, but also extend through the use of policies to avoid exploits of your other backend services.
We expect you to make use of your existing load balancers and firewalls to route the HTTP traffic to Apigee through your DMZ if your network architecture includes a DMZ. The best place to host all components of Apigee, however, is after that DMZ and not in the DMZ itself.
It should also be noted that with Apigee hybrid it is no longer possible to separate the Apigee router from the Apigee Message Processor. This is because with policies such as threat protection, input validation and rate limiting we have full control over payloads and how they are deserialized. This means that even insecure deserialization attacks can be invalidated with the judicious use of Apigee policies.
