Setup apigee in environment

Google Cloud Apigee
1

I wanted to get your expert guidance on a connectivity challenge we are facing in our current apigee setup and understand the best way forward from an Apigee standpoint.

Context / current setup

  • We have Apigee deployed in GCP under the abc environment, which exposes APIs .

  • These APIs need to integrate with backend services hosted in GCP under the def environmen t.

  • Both abc and def environments are within xyz, but they are separate GCP projec ts.

Security verdict so far,we have already discussed this with the security team, and the constra ints are:

  • :cross_mark:Shared VPN cannot be used, as the existing abc–def VPN is already reserved for legacy/old projects.

  • :cross_mark:Private Service Connect (PSC) is not approved as per the current secur ity policy.

  • :white_check_mark:The only approved and feasible option per security is to connect via an intermediary proxy setup.

What we need your help onGiven the above, I’d really value your view on:

  1. How best to architect this proxy-based connectivityfrom Apigee (abc) to backend services in def

    • e.g. Apigee → pro xy → def backend

  2. What kind of proxy pattern is typically recommended in such setups
    (e.g. Apigee HTTP(S) target via public/internal proxy, controll ed ingress, etc.)

  3. n eed help with :

    • design validation

    • proxy configuration

    • security considerations

2

Hello @supriyokumar274!

We wanted to let you know we’re keeping your new question on our radar. While we wait for the community and experts to weigh in, you might find these resources helpful:

We encourage our community to share their thoughts. Thanks for reaching out to the community!

3

The reference you are looking for is described in our documentation as “Forward Proxy”. About environments and environment groups  |  Apigee  |  Google Cloud Documentation This is available for both Apigee X and Apigee Hybrid, though the configuration is a little different between them.

For Apigee X you have the abalibty to define a forward proxy at both the per-proxy and per-environment level.

  1. About environments and environment groups  |  Apigee  |  Google Cloud Documentation
  2. Working with environments  |  Apigee  |  Google Cloud Documentation - You will need to update your environment object and set this via the apigee.googleapis.com endpoint REST Resource: organizations.environments  |  Apigee  |  Google Cloud Documentation

In Hybrid these same options are available however you can also set this at install time Configure forward proxying for API proxies  |  Apigee  |  Google Cloud Documentation

As for your concerns on design and architecture Apigee does not prescribe anything specific. A few notes however on proxy configuration. If, and only if all of your traffic must egress through the forward proxy setting the environment option may be the desired approach since this does not require setting this option on every proxy. Some policies allow skipping or customizing forward proxy behavior as needed too should you have internal vs external routing choices. Hope this helps get you started in the right direction.