SPEAKER: How can you add policies to an API proxy
in Apigee API management to enforce security controls?
This is the third in a series of introductory videos on Apigee
API management.
If you followed the first two, you
have Apigee API management set up.
And you've created a pass through proxy.
You've successfully invoked it.
Now, let's extend it.
In this video, we will show you how to add a policy
to perform rate limiting.
We'll see how to update policy configuration,
and we'll learn about request and response flows.
And we'll get a quick introduction
to the Apigee community, a great online resource
for getting help.
Let's go.
[MUSIC PLAYING]
In the Apigee UI, navigate to the proxy list
and the first proxy you created.
Select the Overview tab.
From here, undeploy the proxy.
After that, it will no longer be listening for inbound requests.
Flip to the Develop tab to modify the proxy.
Here, you can change any of the choices you made previously
in the wizard, the base path, and the target endpoint.
And you can add policies.
In Apigee, policies are reusable logic steps
that perform a specific action on the request.
These can be enforced on the request
flow after the proxy receives the inbound request
but before the proxy connects with the target
or on the response flow after the proxy receives the response
from the target but before it sends that response
to the original client.
Let's add a rate limit policy.
I want Apigee to enforce that on the request flow.
So I'll select the proxy endpoint, the request
free flow, and click the icon to add a policy.
I need to create a new policy here.
There's a list to choose from all the built-in policy types.
There are policies for caching, credential verification,
spike arrest, threat protection, and more.
Each policy has different configuration options.
Let's click a link to find documentation
on the quota policy.
Back in the Apigee Proxy Editor, I'll
add a quota policy to enforce the rate limit.
Each policy gets a name.
I'll name this one Quota 1, then click Create,
and add it to my flow.
Here, I see it displayed in the Proxy Editor.
Clicking on the link, I can see the pre-populated configuration
for the quota policy showing lots of options.
The quota policy in Apigee is remarkably flexible.
Based on my reading of the documentation,
I'm going to replace that configuration with something
simpler.
A basic configuration that tells Apigee
to allow four requests per minute.
Now, save the proxy as a new revision
and deploy that revision.
Again, this will take a few moments
after which the updated proxy will
be handling inbound requests.
Now, I'll flip to my browser tab and reload it several times.
After a few requests, you can see that the rate
limit gets enforced.
The error message tells the caller
that a limit has been reached.
Back in the Apigee UI, if I like,
I can modify the quota configuration
to allow, oh, maybe 100 requests per minute.
It's that easy, and I can add another policy.
This one will execute in the response flow.
I want to add a few headers to the response
that the client will receive describing the rate limits.
We use the Assign Message policy for that.
Assign Message can manipulate any part
of a request or response message, including the headers.
And the documentation page for assigned message
gives lots of examples.
Save and deploy the new revision to get this new rate limit
and the new response headers.
Now, flipping to my terminal window,
I can invoke the updated proxy from cURL.
And yes, we can see the new headers in the response.
There's a lot of flexibility with Apigee.
If you ever need assistance, you can visit the Apache community.
It's available right here at this icon.
It provides a knowledge base and a Q&A forum
for all things Apigee.
For example, if you have a question on the quota policy,
it's easy to search.
Or you can post a new question.
Plenty of experts are willing to help you out.
Let's wrap up.
In this video, you learned about policies
as the configurable logic that allows you to enforce controls
on your API proxies.
We saw the proxy editor.
And you deployed new revisions of proxies
with different policies.
You learned about the quota and Assign Message policies.
And I showed you the Apache community,
an invaluable support resource.
In the next video, I'll cover how to add API key verification
to an API proxy.
We'll see you there.
And don't forget to like and subscribe.
[MUSIC PLAYING]