You are designing an AKS-based microservices architecture accessible from consumer VMs on the same virtual network. Requirements: ingress must be restricted to a single private IP and protected using mutual TLS, incoming calls must be rate-limited, and costs should be minimized. Which solution meets these requirements?

Azure API Management Premium tier with a virtual network connection is the correct choice. The Premium tier supports virtual network integration, allowing the API Management instance to be injected into your VNet and accessed via a private IP, fulfilling the private IP and consumer VM access requirements. It natively supports mutual TLS for enhanced security and offers robust rate-limiting capabilities. The Premium tier, while not the cheapest, is the only option that satisfies all the specified requirements for private access, mutual TLS, and rate limiting within a VNet. Azure App Gateway with WAF does not inherently support mutual TLS for backend services and is primarily an L7 load balancer, not a full API gateway. Azure API Management Standard tier lacks virtual network integration, meaning it cannot be accessed via a private IP within your VNet. Azure Front Door is a global, public-facing service and does not integrate with private virtual networks to provide a private IP for ingress.