apim_checklist.zh-Hant.json

{
    "$schema": "checklist.schema.json",
    "categories": [
        {
            "name": "身份和訪問管理"
        },
        {
            "name": "網路拓撲和連接"
        },
        {
            "name": "安全"
        },
        {
            "name": "管理"
        },
        {
            "name": "統轄"
        },
        {
            "name": "平臺自動化和DevOps"
        }
    ],
    "items": [
        {
            "category": "統轄",
            "guid": "d7941d4a-7b6f-458f-8714-2f8f8c059ad4",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-error-handling-policies",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "開發最佳實踐",
            "text": "在全域級別實施錯誤處理策略",
            "waf": "操作"
        },
        {
            "category": "統轄",
            "guid": "0b0c0765-ff37-4369-90bd-3eb23ce71b08",
            "link": "https://learn.microsoft.com/azure/api-management/set-edit-policies?tabs=form#use-base-element-to-set-policy-evaluation-order",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "開發最佳實踐",
            "text": "確保所有 API 策略都包含一個<base/>元素。",
            "waf": "操作"
        },
        {
            "category": "統轄",
            "guid": "a5c45b03-93b6-42fe-b16b-8fccb6a79902",
            "link": "https://learn.microsoft.com/azure/api-management/policy-fragments",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "開發最佳實踐",
            "text": "使用策略片段可避免在多個 API 中重複相同的策略定義",
            "waf": "操作"
        },
        {
            "category": "統轄",
            "guid": "c3818a95-6ff3-4474-88dc-e809b46dad6a",
            "link": "https://learn.microsoft.com/azure/api-management/monetization-support",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "貨幣",
            "text": "如果您計劃通過 API 獲利，請查看“獲利支援”一文，瞭解最佳做法",
            "waf": "操作"
        },
        {
            "category": "統轄",
            "guid": "a7d0840a-c8c4-4e83-adec-5ca578eb4049",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor#resource-logs",
            "service": "APIM",
            "severity": "高",
            "subcategory": "監測",
            "text": "啟用診斷設置以將日誌導出到 Azure Monitor",
            "waf": "操作"
        },
        {
            "category": "統轄",
            "guid": "8691fa38-45ed-4299-a247-fecd98d35deb",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-app-insights",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "監測",
            "text": "啟用 Application Insights 以獲取更詳細的遙測數據",
            "waf": "操作"
        },
        {
            "category": "統轄",
            "guid": "55fd27bb-76ac-4a91-bc37-049e885be6b7",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-use-azure-monitor",
            "service": "APIM",
            "severity": "高",
            "subcategory": "監測",
            "text": "針對最關鍵的指標配置警報",
            "waf": "操作"
        },
        {
            "category": "身份和訪問管理",
            "guid": "39460bdb-156f-4dc2-a87f-1e8c11ab0998",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#certificate-management-in-azure-key-vault",
            "service": "APIM",
            "severity": "高",
            "subcategory": "數據保護",
            "text": "確保自定義 SSL 證書儲存在 Azure Key Vault 中，以便可以安全地訪問和更新它們",
            "waf": "安全"
        },
        {
            "category": "身份和訪問管理",
            "guid": "e9217997-5f6c-479d-8576-8f2adf706ec8",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-ad-authentication-required-for-data-plane-access",
            "service": "APIM",
            "severity": "高",
            "subcategory": "身份",
            "text": "使用 Azure AD 保護對 API（數據平面）的傳入請求",
            "waf": "安全"
        },
        {
            "category": "身份和訪問管理",
            "guid": "5e5f64ba-c90e-480e-8888-398d96cf0bfb",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-aad",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "身份",
            "text": "使用 Microsoft Entra ID 在開發人員門戶中對用戶進行身份驗證",
            "waf": "安全"
        },
        {
            "category": "身份和訪問管理",
            "guid": "f8e574ce-280f-49c8-b2ef-68279b081cf3",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-create-groups",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "特權訪問",
            "text": "創建適當的組來控制產品的可見性",
            "waf": "安全"
        },
        {
            "category": "管理",
            "guid": "06862505-2d9a-4874-9491-2837b00a3475",
            "link": "https://learn.microsoft.com/azure/api-management/backends",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "最佳做法",
            "text": "使用後端功能消除冗餘 API 後端配置",
            "waf": "操作"
        },
        {
            "category": "管理",
            "guid": "03b125d5-b69b-4739-b7fd-84b86da4933e",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-properties?tabs=azure-portal",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "最佳做法",
            "text": "使用命名值存儲可在策略中使用的通用值",
            "waf": "操作"
        },
        {
            "category": "管理",
            "guid": "beae759e-4ddb-4326-bf26-47f87d3454b6",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "業務連續性和災難恢復",
            "text": "對於DR，利用高級層，跨兩個或多個區域擴展部署，實現99.99%的SLA",
            "waf": "可靠性"
        },
        {
            "category": "管理",
            "guid": "9c8d1664-dd9a-49d4-bd83-950af0af4044",
            "link": "https://learn.microsoft.com/azure/api-management/high-availability",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "業務連續性和災難恢復",
            "text": "在兩個或多個可用區中部署至少一台設備，SLA 提高 99.99%",
            "waf": "可靠性"
        },
        {
            "category": "管理",
            "guid": "8d2db6e8-85c6-4118-a52c-ae76a4f27934",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#service-native-backup-capability",
            "service": "APIM",
            "severity": "高",
            "subcategory": "業務連續性和災難恢復",
            "text": "確保有一個自動備份例程",
            "waf": "可靠性"
        },
        {
            "category": "管理",
            "guid": "43e60b94-7bca-43a2-aadf-efb04d63a485",
            "link": "https://learn.microsoft.com/azure/api-management/retry-policy",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "故障轉移和緩存",
            "text": "使用策略添加故障轉移後端 URL 和緩存，以減少失敗的調用。",
            "waf": "可靠性"
        },
        {
            "category": "管理",
            "guid": "f96ddac5-77ec-4fa9-8833-4327f052059e",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-cache-external",
            "severity": "中等",
            "subcategory": "性能和可擴充性",
            "text": "請考慮對可從緩存中受益的 API 使用外部緩存策略",
            "training": "https://learn.microsoft.com/training/modules/improve-api-performance-with-apim-caching-policy/"
        },
        {
            "category": "管理",
            "guid": "8210699f-8d43-45c2-8f19-57e54134bd8f",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-log-event-hubs",
            "service": "APIM",
            "severity": "低",
            "subcategory": "性能和可擴充性",
            "text": "如果需要以高性能級別進行日誌記錄，請考慮事件中心策略",
            "waf": "操作"
        },
        {
            "category": "管理",
            "guid": "121bfc39-fa7b-4096-b93b-ab56c1bc0bed",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-sample-flexible-throttling",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "性能和可擴充性",
            "text": "應用限制策略來控制每秒的請求數",
            "training": "https://learn.microsoft.com/training/modules/protect-apis-on-api-management/",
            "waf": "性能"
        },
        {
            "category": "管理",
            "guid": "bb5f356b-3daf-47a2-a9ee-867a8100bbd5",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-autoscale",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "性能和可擴充性",
            "text": "配置自動縮放以在負載增加時橫向擴展實例數",
            "waf": "性能"
        },
        {
            "category": "管理",
            "guid": "84b94abb-59b6-4b9d-8587-3413669468e8",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-provision-self-hosted-gateway",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "性能和可擴充性",
            "text": "在 Azure 沒有靠近後端 API 的區域的地方部署自承載閘道。",
            "waf": "性能"
        },
        {
            "category": "管理",
            "guid": "1fe8db45-a017-4888-8c4d-4422583cfae0",
            "link": "https://learn.microsoft.com/azure/api-management/upgrade-and-scale#upgrade-and-scale",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "高級層",
            "text": "將高級層用於生產工作負載。",
            "waf": "可靠性"
        },
        {
            "category": "管理",
            "guid": "1b8d68a4-66cd-44d5-ba94-3ee94440e8d6",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-deploy-multi-region#-route-api-calls-to-regional-backend-services",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "請求路由",
            "text": "在多區域模型中，使用策略根據可用性或延遲將請求路由到區域後端。",
            "waf": "可靠性"
        },
        {
            "category": "管理",
            "guid": "46f07d33-ef9a-44e8-8f98-67c097c5d8cd",
            "link": "https://learn.microsoft.com/azure/azure-resource-manager/management/azure-subscription-service-limits#api-management-limits",
            "service": "APIM",
            "severity": "高",
            "subcategory": "資源限制",
            "text": "注意APIM的局限性",
            "waf": "可靠性"
        },
        {
            "category": "管理",
            "guid": "10f58602-f0f9-4d77-972a-956f6e0f2600",
            "link": "https://learn.microsoft.com/en-us/azure/api-management/self-hosted-gateway-overview",
            "service": "APIM",
            "severity": "高",
            "subcategory": "自託管",
            "text": "確保自承載閘道部署具有復原能力。",
            "waf": "可靠性"
        },
        {
            "category": "網路拓撲和連接",
            "guid": "7519e385-a88b-4d34-966b-6269d686e890",
            "link": "https://learn.microsoft.com/azure/api-management/front-door-api-management",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "連接",
            "text": "在APIM前面使用 Azure Front Door 進行多區域部署",
            "waf": "性能"
        },
        {
            "category": "網路拓撲和連接",
            "guid": "cd45c90e-7690-4753-930b-bf290c69c074",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#virtual-network-integration",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "安全",
            "text": "在虛擬網络 （VNet） 中部署服務Deploy the service within a Virtual Network （VNet）",
            "waf": "安全"
        },
        {
            "category": "網路拓撲和連接",
            "guid": "02661582-b3d1-48d1-9d7b-c6a918a0ca33",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#network-security-group-support",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "安全",
            "text": "將網路安全組 （NSG） 部署到子網，以限制或監視進出APIM的流量。",
            "waf": "安全"
        },
        {
            "category": "網路拓撲和連接",
            "guid": "67437a28-2721-4a2c-becd-caa54c8237a5",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#azure-private-link",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "安全",
            "text": "部署專用終結點以在未將APIM部署到 VNet 時篩選傳入流量。",
            "waf": "安全"
        },
        {
            "category": "網路拓撲和連接",
            "guid": "d698adbd-3288-44cb-b10a-9b572da395ae",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#disable-public-network-access",
            "service": "APIM",
            "severity": "高",
            "subcategory": "安全",
            "text": "禁用公網訪問",
            "waf": "安全"
        },
        {
            "category": "平臺自動化和DevOps",
            "guid": "0674d750-0c6f-4ac0-8717-ceec04d0bdbd",
            "link": "https://learn.microsoft.com/azure/api-management/automation-manage-api-management",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "自動化",
            "text": "使用 PowerShell 自動化腳本簡化管理",
            "waf": "操作"
        },
        {
            "category": "平臺自動化和DevOps",
            "guid": "c385bfcd-49fd-4786-81ba-cedbb4c57345",
            "link": "https://learn.microsoft.com/azure/cloud-adoption-framework/scenarios/app-platform/api-management/platform-automation-and-devops#design-recommendations",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "最佳做法",
            "text": "通過基礎架構即代碼配置APIM。查看 Cloud Adaption Framework 中的 DevOps 最佳實踐 APIM 登陸區域加速器",
            "waf": "操作"
        },
        {
            "category": "平臺自動化和DevOps",
            "guid": "6c3a27c0-197f-426c-9ffa-86fed51d9ab6",
            "link": "https://learn.microsoft.com/azure/api-management/visual-studio-code-tutorial",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "最佳做法",
            "text": "促進 Visual Studio Code APIM 擴展的使用，以加快 API 開發速度",
            "waf": "操作"
        },
        {
            "category": "平臺自動化和DevOps",
            "guid": "354f1c03-8112-4965-85ad-c0074bddf231",
            "link": "https://learn.microsoft.com/azure/api-management/devops-api-development-templates",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "DevOps的",
            "text": "在工作流中實施DevOps和 CI/CD",
            "waf": "操作"
        },
        {
            "category": "安全",
            "guid": "b6439493-426a-45f3-9697-cf65baee208d",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates-for-clients",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "蜜蜂屬",
            "text": "使用用戶端證書身份驗證保護 API",
            "waf": "安全"
        },
        {
            "category": "安全",
            "guid": "2a67d143-1033-4c0a-8732-680896478f08",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-mutual-certificates",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "蜜蜂屬",
            "text": "使用用戶端證書身份驗證保護後端服務",
            "waf": "安全"
        },
        {
            "category": "安全",
            "guid": "074435f5-4a46-41ac-b521-d6114cb5d845",
            "link": "https://learn.microsoft.com/azure/api-management/mitigate-owasp-api-threats",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "蜜蜂屬",
            "text": "查看“緩解 OWASP API 安全前 10 大威脅的建議”一文，並查看適用於您的 API 的內容",
            "waf": "安全"
        },
        {
            "category": "安全",
            "guid": "5507c4b8-a7f8-41d6-9661-418c987100c9",
            "link": "https://learn.microsoft.com/azure/api-management/authorizations-overview",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "蜜蜂屬",
            "text": "使用授權功能簡化後端 API 的 OAuth 2.0 令牌管理",
            "waf": "安全"
        },
        {
            "category": "安全",
            "guid": "2deee033-b906-4bc2-9f26-c8d3699fe091",
            "link": "https://learn.microsoft.com/azure/api-management/api-management-howto-manage-protocols-ciphers",
            "service": "APIM",
            "severity": "高",
            "subcategory": "密碼",
            "text": "加密傳輸中的資訊時，請使用最新的 TLS 版本。盡可能禁用過時和不必要的協議和密碼。",
            "waf": "安全"
        },
        {
            "category": "安全",
            "guid": "f8af3d94-1d2b-4070-846f-849197524258",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#im-8-restrict-the-exposure-of-credential-and-secrets",
            "service": "APIM",
            "severity": "高",
            "subcategory": "數據保護",
            "text": "確保機密（命名值）存儲在 Azure Key Vault 中，以便可以安全地訪問和更新它們",
            "waf": "安全"
        },
        {
            "category": "安全",
            "guid": "791abd8b-7706-4e31-9569-afefde724be3",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#managed-identities",
            "service": "APIM",
            "severity": "中等",
            "subcategory": "身份",
            "text": "盡可能使用託管標識向其他 Azure 資源進行身份驗證",
            "waf": "安全"
        },
        {
            "category": "安全",
            "guid": "220c4ca6-6688-476b-b2b5-425a78e6fb87",
            "link": "https://learn.microsoft.com/security/benchmark/azure/baselines/api-management-security-baseline?toc=%2Fazure%2Fapi-management%2F&bc=%2Fazure%2Fapi-management%2Fbreadcrumb%2Ftoc.json#ns-6-deploy-web-application-firewall",
            "service": "APIM",
            "severity": "高",
            "subcategory": "網路",
            "text": "使用 APIM 前面部署應用程式閘道來使用 Web 應用程式防火牆 （WAF）",
            "waf": "安全"
        }
    ],
    "metadata": {
        "name": "Azure API Management Review",
        "state": "GA",
        "timestamp": "June 10, 2024",
        "waf": "all"
    },
    "severities": [
        {
            "name": "高"
        },
        {
            "name": "中等"
        },
        {
            "name": "低"
        }
    ],
    "status": [
        {
            "description": "此檢查尚未查看",
            "name": "未驗證"
        },
        {
            "description": "有一個與此檢查關聯的操作項",
            "name": "打開"
        },
        {
            "description": "此檢查已通過驗證，並且沒有與之關聯的進一步操作項",
            "name": "實現"
        },
        {
            "description": "建議已理解，但當前需求不需要",
            "name": "不需要"
        },
        {
            "description": "不適用於當前設計",
            "name": "不適用"
        }
    ],
    "waf": [
        {
            "name": "可靠性"
        },
        {
            "name": "安全"
        },
        {
            "name": "成本"
        },
        {
            "name": "操作"
        },
        {
            "name": "性能"
        }
    ],
    "yesno": [
        {
            "name": "是的"
        },
        {
            "name": "不"
        }
    ]
}