🛡️ Azure API Management service in a capacity-based tier has no active APIs🟢

• Contextual name: 🛡️ Capacity-based service has no active APIs🟢
• ID: /ce/ca/azure/api-management/no-active-apis
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: COST

Stats

not available

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Azure API Management Service
  • 🔌 Azure API Management Service - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

This policy identifies successfully provisioned Azure API Management services in non-Consumption tiers that are older than 30 days and have no active related API records in Cloudaware CMDB.

Rationale

Non-Consumption API Management tiers reserve capacity and continue to incur service costs even when the service contains no APIs. Consumption-tier services are excluded because they use a consumption-based cost model.

Impact

An empty capacity-based service creates avoidable cost and inventory overhead. Deleting it without review can disrupt planned deployments or dependencies involving networking, identities, certificates, policies, custom domains, or DNS.

Audit

This policy flags an Azure API Management Service as INCOMPLIANT if it is in the Succeeded provisioning state, uses a non-Consumption SKU, was created more than 30 days ago, and has no non-disappeared related Azure API Management API records.

Remediation

Open File

Remediation

Verify the API inventory directly in Azure before changing or deleting the service.

From Azure Portal

1. Open API Management services.
2. Select the affected service.
3. Under APIs, confirm that no APIs are listed.

If APIs exist in Azure but are absent from Cloudaware CMDB, investigate collection permissions or synchronization before proceeding.

From Azure CLI

Run the following command:

az apim api list \
  --resource-group <resource-group-name> \
  --service-name <api-management-service-name>

An empty result confirms that Azure currently reports no APIs for the service.

Review and Remediate

1. Confirm the service owner and verify that no API deployment is planned.
2. Review custom domains, DNS records, networking, private endpoints, identities, certificates, named values, policies, diagnostic settings, and automation that references the service.
3. If the service is unused, delete it through the approved change process.
4. If the service is reserved for planned use or retains required dependencies,

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Waste Reduction			30		no data