Use Application Integration

This page provides information intended for existing Apigee customers who want to use Application Integration with the same Google Cloud project.

Overview

All Apigee subscription users who had enabled the Apigee Integrations add-on, will now be redirected to Application Integration at no additional cost. Application Integration is set up for you, and all your existing integrations in Apigee were automatically synchronized and available to use. This means that you can continue to use your existing Google Cloud project for Application Integration without any additional configurations.

To know more about Application Integration, see Application Integration overview.

From the Apigee portal, you will be redirected to Application Integration:

Redirect from Apigee to Application Integration Redirect from Apigee to Application Integration

What has changed?

The following table provides a summary of the expected differences or changes in your Google Cloud project:

Apigee resource/feature Changes
IAM permissions Integrations now use the predefined Application Integration IAM roles.

See IAM permission changes.
Service account A new default service account is created that is used for all integrations.

See Service account changes.
REST APIs Use Application Integration REST API.

See REST API changes.
Send Email task and Approval task The sender email address is changed for all outgoing emails.

See Integration task changes.

IAM permission changes

All existing user accounts or principals are granted with equivalent Predefined Application Integration IAM permissions.

Application Integration IAM permissions have the following format:

Format

integrations.integrationRESOURCE.ACTION

Example

integrations.integrationVersions.get

Custom IAM role limitations

The following limitations apply if you have defined custom IAM roles in your Google Cloud project:

  • Apigee proxies using a service account with custom IAM roles containing Apigee Integration permissions might fail. We recommend that you update your custom IAM roles with the Application Integration IAM permissions.

For information about IAM roles and permissions, see Access control overview.

Service account changes

A new default service account with the Application Integration Service Agent (roles/integrations.serviceAgent) IAM role is created in your Google Cloud project.

The new Application Integration default service account is used for the following integration operations:

  • To run an integration.
  • To invoke a Cloud Function using the Cloud Function task.
  • To call an Integration Connector using the Connectors task.
  • To create service account tokens for Service account type authentication profiles.
  • To encrypt and decrypt Cloud KMS keys for authentication profiles.

Application Integration default service account has the following email address:

Format

  service-PROJECT_NUMBER@gcp-sa-integrations.iam.gserviceaccount.com

Example

  [email protected]

For information about service accounts, see Access control overview.

REST API changes

In general, most of the Apigee Integration APIs have their respective Application Integration API equivalents.

The following table describes the key change in the REST APIs of Application Integration when compared to Application Integration:

Apigee Integration (including Apigee proxy) Application Integration
REST Resource projects/PROJECT_ID/locations/REGION/products/apigee/integration/INTEGRATION_NAME projects/PROJECT_ID/locations/REGION/integration/INTEGRATION_NAME

For information about Application Integration APIs, see Application Integration REST API.

Integration task changes

The Send Email task and the Approval task will use [email protected] to send email notifications. In addition, all the approval request emails sent using the Approval task will link to Application Integration.