How to implement disaster recovery using service backup and restore in Azure API Management

Sign in with Azure PowerShell.

In the following examples:

• An API Management instance named myapim is in resource group apimresourcegroup.
• A storage account named backupstorageaccount is in resource group storageresourcegroup. The storage account has a container named backups.
• A backup blob will be created with name ContosoBackup.apimbackup.

Set variables in PowerShell:

$apiManagementName="myapim";
$apiManagementResourceGroup="apimresourcegroup";
$storageAccountName="backupstorageaccount";
$storageResourceGroup="storageresourcegroup";
$containerName="backups";
$blobName="ContosoBackup.apimbackup"

Access using storage access key

$storageKey = (Get-AzStorageAccountKey -ResourceGroupName $storageResourceGroup -StorageAccountName $storageAccountName)[0].Value

$storageContext = New-AzStorageContext -StorageAccountName $storageAccountName -StorageAccountKey $storageKey

Backup-AzApiManagement -ResourceGroupName $apiManagementResourceGroup -Name $apiManagementName `
    -StorageContext $storageContext -TargetContainerName $containerName -TargetBlobName $blobName

Access using managed identity

To configure a managed identity in your API Management instance to access the storage account, see Configure a managed identity, earlier in this article.

Access using system-assigned managed identity

$storageContext = New-AzStorageContext -StorageAccountName $storageAccountName

Backup-AzApiManagement -ResourceGroupName $apiManagementResourceGroup -Name $apiManagementName `
    -StorageContext $storageContext -TargetContainerName $containerName `
    -TargetBlobName $blobName -AccessType "SystemAssignedManagedIdentity"

Access using user-assigned managed identity

In this example, a user-assigned managed identity named myidentity is in resource group identityresourcegroup.

$identityName = "myidentity";
$identityResourceGroup = "identityresourcegroup";

$identityId = (Get-AzUserAssignedIdentity -Name $identityName -ResourceGroupName $identityResourceGroup).ClientId

$storageContext = New-AzStorageContext -StorageAccountName $storageAccountName

Backup-AzApiManagement -ResourceGroupName $apiManagementResourceGroup -Name $apiManagementName `
    -StorageContext $storageContext -TargetContainerName $containerName `
    -TargetBlobName $blobName -AccessType "UserAssignedManagedIdentity" ` -identityClientId $identityid

Backup is a long-running operation that may take several minutes to complete. During this time the API gateway continues to handle requests, but the state of the service is Updating.

Sign in with Azure CLI.

In the following examples:

• An API Management instance named myapim is in resource group apimresourcegroup.
• A storage account named backupstorageaccount is in resource group storageresourcegroup. The storage account has a container named backups.
• A backup blob will be created with name ContosoBackup.apimbackup.

Set variables in Bash:

apiManagementName="myapim";
apiManagementResourceGroup="apimresourcegroup";
storageAccountName="backupstorageaccount";
storageResourceGroup="storageresourcegroup";
containerName="backups";
backupName="ContosoBackup.apimbackup";

Access using storage access key

storageKey=$(az storage account keys list --resource-group $storageResourceGroup --account-name $storageAccountName --query [0].value --output tsv)

az apim backup --resource-group $apiManagementResourceGroup --name $apiManagementName \
    --storage-account-name $storageAccountName --storage-account-key $storageKey --storage-account-container $containerName --backup-name $backupName

Backup is a long-running operation that may take several minutes to complete. During this time the API gateway continues to handle requests, but the state of the service is Updating.

See Azure REST API reference for information about authenticating and calling Azure REST APIs.

To back up an API Management service, issue the following HTTP request:

POST https://management.chinacloudapi.cn/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName}/backup?api-version={api-version}

where:

• subscriptionId - ID of the subscription that holds the API Management service you're trying to back up
• resourceGroupName - name of the resource group of your Azure API Management service
• serviceName - the name of the API Management service you're making a backup of specified at the time of its creation
• api-version - a valid REST API version such as 2021-08-01 or 2021-04-01-preview.

In the body of the request, specify the target storage account name, blob container name, backup name, and the storage access type. If the storage container doesn't exist, the backup operation creates it.

Access using storage access key

{
    "storageAccount": "{storage account name for the backup}",
    "containerName": "{backup container name}",
    "backupName": "{backup blob name}",
    "accessKey": "{access key for the account}"
}

Access using managed identity

Access using system-assigned managed identity

{
    "storageAccount": "{storage account name for the backup}",
    "containerName": "{backup container name}",
    "backupName": "{backup blob name}",
    "accessType": "SystemAssignedManagedIdentity"
}

Access using user-assigned managed identity

{
    "storageAccount": "{storage account name for the backup}",
    "containerName": "{backup container name}",
    "backupName": "{backup blob name}",
    "accessType": "UserAssignedManagedIdentity",
    "clientId": "{client ID of user-assigned identity}"
}

Set the value of the Content-Type request header to application/json.

Backup is a long-running operation that may take several minutes to complete. If the request succeeded and the backup process began, you receive a 202 Accepted response status code with a Location header. Make GET requests to the URL in the Location header to find out the status of the operation. While the backup is in progress, you continue to receive a 202 Accepted status code. During this time the API gateway continues to handle requests, but the state of the service is Updating. A Response code of 200 OK indicates successful completion of the backup operation.

In the following examples,

• An API Management instance named myapim is restored from the backup blob named ContosoBackup.apimbackup in storage account backupstorageaccount.
• The backup blob is in a container named backups.

Set variables in PowerShell:

$apiManagementName="myapim";
$apiManagementResourceGroup="apimresourcegroup";
$storageAccountName="backupstorageaccount";
$storageResourceGroup="storageresourcegroup";
$containerName="backups";
$blobName="ContosoBackup.apimbackup"

Access using storage access key

$storageKey = (Get-AzStorageAccountKey -ResourceGroupName $storageResourceGroup -StorageAccountName $storageAccountName)[0].Value

$storageContext = New-AzStorageContext -StorageAccountName $storageAccountName -StorageAccountKey $storageKey

Restore-AzApiManagement -ResourceGroupName $apiManagementResourceGroup -Name $apiManagementName `
    -StorageContext $storageContext -SourceContainerName $containerName -SourceBlobName $blobName

Access using managed identity

To configure a managed identity in your API Management instance to access the storage account, see Configure a managed identity, earlier in this article.

Access using system-assigned managed identity

$storageContext = New-AzStorageContext -StorageAccountName $storageAccountName

Restore-AzApiManagement -ResourceGroupName $apiManagementResourceGroup -Name $apiManagementName `
    -StorageContext $storageContext -SourceContainerName $containerName `
    -SourceBlobName $blobName -AccessType "SystemAssignedManagedIdentity"

Access using user-assigned managed identity

In this example, a user-assigned managed identity named myidentity is in resource group identityresourcegroup.

$identityName = "myidentity";
$identityResourceGroup = "identityresourcegroup";

$identityId = (Get-AzUserAssignedIdentity -Name $identityName -ResourceGroupName $identityResourceGroup).ClientId

$storageContext = New-AzStorageContext -StorageAccountName $storageAccountName

Restore-AzApiManagement -ResourceGroupName $apiManagementResourceGroup -Name $apiManagementName `
    -StorageContext $storageContext -SourceContainerName $containerName `
    -SourceBlobName $blobName -AccessType "UserAssignedManagedIdentity" ` -identityClientId $identityid

Restore is a long-running operation that may take up to 45 minutes or more to complete.

In the following examples,

• An API Management instance named myapim is restored from the backup blob named ContosoBackup.apimbackup in storage account backupstorageaccount.
• The backup blob is in a container named backups.

Set variables in Bash:

apiManagementName="myapim";
apiManagementResourceGroup="apimresourcegroup";
storageAccountName="backupstorageaccount";
storageResourceGroup="storageresourcegroup";
containerName="backups";
backupName="ContosoBackup.apimbackup"

Access using storage access key

storageKey=$(az storage account keys list --resource-group $storageResourceGroup --account-name $storageAccountName --query [0].value --output tsv)

az apim restore --resource-group $apiManagementResourceGroup --name $apiManagementName \
    --storage-account-name $storageAccountName --storage-account-key $storageKey --storage-account-container $containerName --backup-name $backupName

Restore is a long-running operation that may take up to 45 minutes or more to complete.

To restore an API Management service from a previously created backup, make the following HTTP request:

POST https://management.chinacloudapi.cn/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName}/restore?api-version={api-version}

where:

• subscriptionId - ID of the subscription that holds the API Management service you're restoring a backup into
• resourceGroupName - name of the resource group that holds the Azure API Management service you're restoring a backup into
• serviceName - the name of the API Management service being restored into specified at its creation time
• api-version - a valid REST API version such as 2021-08-01 or 2021-04-01-preview

In the body of the request, specify the existing storage account name, blob container name, backup name, and the storage access type.

Access using storage access key

{
    "storageAccount": "{storage account name for the backup}",
    "containerName": "{backup container name}",
    "backupName": "{backup blob name}",
    "accessKey": "{access key for the account}"
}

Access using managed identity

Access using system-assigned managed identity

{
    "storageAccount": "{storage account name for the backup}",
    "containerName": "{backup container name}",
    "backupName": "{backup blob name}",
    "accessType": "SystemAssignedManagedIdentity"
}

Access using user-assigned managed identity

{
    "storageAccount": "{storage account name for the backup}",
    "containerName": "{backup container name}",
    "backupName": "{backup blob name}",
    "accessType": "UserAssignedManagedIdentity",
    "clientId": "{client ID of user-assigned identity}"
}

Set the value of the Content-Type request header to application/json.

Restore is a long-running operation that may take up to 30 or more minutes to complete. If the request succeeded and the restore process began, you receive a 202 Accepted response status code with a Location header. Make GET requests to the URL in the Location header to find out the status of the operation. While the restore is in progress, you continue to receive a 202 Accepted status code. A response code of 200 OK indicates successful completion of the restore operation.