Skip to main content

Self-Managed IO River Security in Akamai

IO River normally provisions and manages the Akamai configuration required to route traffic through its security services for you. If you prefer (or need) to configure this yourself directly in Akamai Property Manager, this guide walks through creating the IOR-Security Akamai Include by hand, rule by rule, so the result matches the configuration IO River would otherwise create automatically. You can then attach this Include to different properties.

What this Include does​

The IOR-Security Include reroutes a copy of each request to IO River's security layer for inspection before it reaches your real origin.

The Include is created once per account/contract. Once it exists, it can be attached to any number of properties that need IO River security enabled — each property just adds a reference to it and supplies its own service ID and origin values.

This guide has two parts:

  • Part A – create the IOR-Security Include itself (one-time setup).
  • Part B – attach the Include to a property that needs IO River security (repeat for every property).

Part A – Create the IOR-Security Include​

Prerequisites​

Before you start, make sure you have access to Akamai Control Center with permission to create Includes on the relevant contract/group.

Step 1 – Create the Include​

  1. In Akamai Control Center, go to Content Delivery → Properties → Includes.
  2. Click New Include.
    1. Select the product and click Create Include.
    2. Enter a Name: IOR-Security.
    3. Set Include Type to Common settings.
    4. Select the Group and Rule Format.
    5. Click Next and then Save.
important

The Include's Rule Format must match the rule format of every property it's attached to. If a property later upgrades its rule format, update this Include's rule format to match before re-activating the property, otherwise activation will fail or behaviors may not validate correctly.

Step 2 – Add the variables​

Within the Include version you just created, go to the Variables tab and add the following variables. Akamai will automatically namespace them with the Include's ID (shown as PMINC<includeId>_<name> in the rule tree) — you only need to type the name shown below.

NameHiddenSensitiveDefault value
IORIVER_CLEAREDYesNo(leave blank or any placeholder)
IORIVER_ASNYesNo(leave blank or any placeholder)
IORIVER_CITYYesNo(leave blank or any placeholder)
IORIVER_COUNTRYYesNo(leave blank or any placeholder)
IORIVER_REGIONYesNo(leave blank or any placeholder)

The default value doesn't matter — each variable is overwritten at runtime by a setVariable behavior before it's used.

Step 3 – Create the "IORiver-Variables" rule​

  1. Under the Include's default rule, click +Rules to add a new child rule.
  2. Name it IORiver-Variables and click on Insert Rule.
  3. Leave the criteria empty, so the rule always matches.
  4. Add behavior Set Variable:
    • Variable: select IORIVER_CLEARED
    • Create Value From: select Extract
    • Get Data From: select Request Header
    • Header Name: x-ior-cleared
    • Operation: None
  5. Save the rule.

Step 4 – Create the "IORiver-Security" rule​

  1. Add another child rule under default, named IORiver-Security.

  2. Add a Variable criterion:

    • Variable: select IORIVER_CLEARED
    • Match Operator: is not
    • Value: {{parent.PMUSER_IORIVER_SERVICE_ID}} (type this as a literal variable reference — this is a property-level variable supplied later in Part B, not something you define here)

  3. Add the following behaviors, in this order:

    a. Set Variable (ASN)

    • Variable: select IORIVER_ASN
    • Create Value From: select Extract
    • Get Data From: select EdgeScape Data
    • EdgeScape Field: select AS Number
    • Operation: None

    b. Set Variable (City)

    • Variable: select IORIVER_CITY
    • Create Value From: select Extract
    • Get Data From: select EdgeScape Data
    • EdgeScape Field: select City
    • Operation: None

    c. Set Variable (Country)

    • Variable: select IORIVER_COUNTRY
    • Create Value From: select Extract
    • Get Data From: select EdgeScape Data
    • EdgeScape Field: select Country Code
    • Operation: None

    d. Set Variable (Region)

    • Variable: select IORIVER_REGION
    • Create Value From: select Extract
    • Get Data From: select EdgeScape Data
    • EdgeScape Field: select Region Code
    • Operation: None

    e. Modify Outgoing Request Header (override Host)

    • Action: Add
    • Select header name: Other
    • Custom header name: Host
    • Header value: {{parent.PMUSER_IORIVER_SECURITY_ORIGIN}}

    f. Origin Server — route the request to the security layer:

    • Origin Type: Your own origin
    • Origin Server Hostname: {{parent.PMUSER_IORIVER_SECURITY_ORIGIN}}
    • Forward Host Header: Origin Hostname
    • Cache Key Hostname: Origin Hostname
    • Origin SSL Certificate Verification:
      • Verification Settings: Choose Your Own
    • Rest of the settings should be default

    g. Modify Outgoing Request Header (sidecar marker)

    • Action: Add
    • Select header name: Other
    • Custom header name: x-ior-security-sidecar
    • Header value: true

    h. Modify Outgoing Request Header (preserve original host)

    • Action: Add
    • Select header name: Other
    • Custom header name: x-ior-original-host
    • Header value: {{builtin.AK_HOST}}

  4. Save the rule.

Your rule tree under default should now contain exactly two child rules, IORiver-Variables and IORiver-Security.

Step 5 – Validate and activate the Include​

Activate the IOR-Security Include on Staging, then later on Production. It's fine to activate it now even though no property references it yet — Part B attaches it to one or more properties.

The Include itself is now ready to be reused by any property. The rest of this guide is Part B, which you repeat for each property that needs IO River security enabled.

Part B – Attach the Include to a property​

Prerequisites​

IORIVER_SERVICE_ID and IORIVER_SECURITY_ORIGIN are only needed at this point — they are property-level values, not part of the Include itself. Before you start, have ready:

  • Your IO River Service ID for this specific property.
  • The hostname of the IO River Security Origin – presented inside the service, under the CDN Providers tab.

Step 1 – Define the property variables​

  1. Open the property that should use this security integration.

  2. Go to Property Variables on the property and add two User Variables (if they don't already exist):

    • IORIVER_SERVICE_ID – set to this property's IO River service ID.
    • IORIVER_SECURITY_ORIGIN – set to the security layer origin hostname.

    Akamai automatically namespaces user variables with a PMUSER_ prefix, so these resolve to PMUSER_IORIVER_SERVICE_ID and PMUSER_IORIVER_SECURITY_ORIGIN — matching the {{parent.*}} references used inside the Include. They must be defined on the property (the Include's parent), not inside the Include itself.

Step 2 – Reference the Include​

  1. In the property's rule tree, add a child rule under the Default Rule called IORiver-Security-Rule
  2. Under this rule, add a behavior Include, and select IOR-Security
  3. Save the property version.
important

Make sure that the IORiver-Security-Rule rule is placed as the last rule in the property rules.

Step 3 – Activate​

  1. Activate the property version on Staging.
  2. Test against the staging hostname: confirm requests are routed to the security layer - you can review such requests in IO River's Security Analytics page.
  3. Once verified, activate the property on Production.