Securing Kong Gateway

The Admin API provides a RESTful interface for configuring Kong Gateway entities. Because this API allows full control of Kong Gateway, it is important to secure this API against unwanted access.

Customize the data Kong Gateway logs to protect private data for GDPR.

Recommended network and firewall settings for Kong Gateway.

Configure single sign-on for Konnect and see SSO IdP options.

Manage authorization with teams and roles using the least privilege model.

Manage Kong Gateway user permissions with role-based access control (RBAC).

Store and use sensitive data (like public and private keys, API keys, and certificates) as secrets in environment variables or in a Vault, and configure secret rotation.

Configure Keys as a representation of asymmetric public or private keys.

Group Keys to use as a Key Set.

Encrypt sensitive Kong Gateway fields before storing them in a database.

Learn how to configure and use Kong Gateway logs to detect security concerns.

Audit logs provides details for HTTP requests handled by the Admin API as well as database changes.

Use audit logs to help you detect and respond to potential security incidents when they occur.

Log and monitor Kong Gateway activity with plugins.

Report security vulnerabilities and see Kong’s vulnerability management policy.

Read Kong’s version support policy