Northern Trail Outfitters (NTO) has recently changed their Corporate Security Guidelines. The guidelines require that all cloud applications pass…

The core requirement is to establish a secure, firewalled integration between cloud applications and on-premise resources. An API Gateway (A) serves as a dedicated, secure entry point for all incoming requests, allowing for centralized policy enforcement, security screening, and traffic management. To comply with the guideline that all traffic must pass through a secure firewall, the standard architectural pattern is to place this public-facing gateway component within a Demilitarized Zone (DMZ) or perimeter network (B). This isolates the integration layer from the internal trusted network, ensuring all traffic is inspected by firewalls before reaching sensitive on-premise systems.

1. MuleSoft Documentation

"Deployment Models": MuleSoft's Anypoint Platform

a leading integration solution

explicitly describes a hybrid deployment model where the control plane is in the cloud

but the runtime plane (which executes integrations and can host an API Gateway) is deployed on-premises within the customer's network. This on-premise runtime is typically placed in a DMZ to securely mediate access to backend resources. This supports the concepts in both (A) and (B).

Reference: MuleSoft Documentation

About Anypoint Platform > Deployment Models.

2. Richards

M. (2020). Fundamentals of Software Architecture: An Engineering Approach. O'Reilly Media.

Reference: Chapter 17

"Architectural Patterns

" discusses the API Gateway pattern as a single entry point for a system. Chapter 21

"Deployment Patterns

" implicitly supports placing such edge services in secured network zones like a DMZ for controlled access to internal systems. The combination of these principles validates options A and B.

3. Microsoft Azure Documentation

"Demilitarized zone (DMZ)": This official vendor documentation describes the core concept of a DMZ as a perimeter network that provides a layer of security between the internet (or cloud) and an enterprise's internal network. It explicitly states that components like API gateways are typically deployed in the DMZ.

Reference: Microsoft Azure

Cloud Adoption Framework > Ready > Azure landing zones > Network topology and connectivity > "Implement a secure hybrid network". This section details using a DMZ to protect on-premises resources from cloud-based workloads.