API Security: On-board Apigee Hybrid

Pre-Requisite:  This tutorial assumes that the GCP On-boarding process has already been completed.

Follow these extra steps in order to allow us discover API proxies running on Apigee Hybrid.

Step 1: Enable the Apigee API in the project created for Data Theorem

Go to https://console.cloud.google.com/apis/library/apigee.googleapis.com. Ensure that the project created for Data Theorem during GCP onboarding is currently selected in the project list drop down.

1.  Click on the “Enable API” button near the top of the page.

   • This will allow Data Theorem to access deployed API proxies running within Apigee Hybrid.

Step 2: Create a new Apigee IAM Role

In addition to the permissions granted during GCP onboarding, Data Theorem needs a custom Apigee role to be able to access the deployed APIs and shared flows.

Go to https://console.cloud.google.com/iam-admin/roles/create. Ensure that the project created for Data Theorem is currently selected in the project list drop down.

1. In the "Title" field, input "DataTheoremApigeeDiscovery"

2. In the "ID" field set "DataTheoremApigeeDiscovery"

3. Then click "Add Permissions", in "Filter table" input:

   • apigee.sharedflow*.get

     • then check both apigee.sharedflowrevisions.get and apigee.sharedflows.get

   • reset the filter and input apigee.prox*.get

     • then check apigee.proxies.get and apigee.proxyrevisions.get

   • Finish by clicking "Add"

4. Once done, you should see "4 assigned permissions":

   • apigee.sharedflowrevisions.get

   • apigee.sharedflows.get

   • apigee.proxies.get

   • apigee.proxyrevisions.get

5. Click “Save”

Step 3: Add the role to the "DataTheoremDiscovery" service account

1. Then go to IAM, find the "DataTheoremDiscovery" service account and click "edit"

2. Select "Add another role"

3. Type/select "DataTheoremApigeeDiscovery"

4. Finish by clicking "Save"