Implements security controls at the API gateway layer including authentication enforcement, rate limiting, request validation, IP allowlisting, TLS termination, and threat protection. The engineer configures API gateways (Kong, AWS API Gateway, Azure APIM, Apigee) to act as a centralized security enforcement point that validates, throttles, and monitors all API traffic before it reaches backend services. Activates for requests involving API gateway security, API management security, gateway authentication, or centralized API protection.
Do not use as the sole security layer. API gateways provide defense in depth but backend services must also validate authorization and input.
# kong.yml - Declarative Kong configuration with security plugins
_format_version: "3.0"