Last updated: April 29, 2026
Why this module. Most API-security advice covers north-south (internet to API). In microservices, east-west traffic (service to service) is 10x more volume and often less protected. Compromise one service, lateral movement to others.
The trust model that fails
“Internal services trust each other; auth happens at the edge.” Once an attacker is inside (via vuln in any service), they can hit every other service freely. Modern threat model: zero trust east-west too.
What service mesh provides
Module 11 (Cloud track) covers Istio / Linkerd in depth. For APIs:
- mTLS automatic — every service-to-service call encrypted + authenticated
- Identity per service — “service A” is a verifiable cryptographic identity
- Policy enforcement — service A can call service B on /v1/users only
- Observability — every cross-service call logged with identity
Identity propagation
User authenticates at edge → token issued. Token reaches downstream services. Each service must verify the token (don’t blindly trust upstream).
Pattern:
- Edge gateway validates user JWT
- Gateway issues an internal token signed by internal CA, with user identity embedded
- Internal services verify internal token; act with user identity
- Audit log captures user + service chain
Authorization in microservices
Two patterns:
- Centralised — every service calls a Policy Decision Point (PDP) for authz. Open Policy Agent (OPA) is the standard.
- Distributed — each service has authz code. Faster but inconsistent.
Centralised is harder to scale; distributed has consistency drift. Modern pattern: OPA sidecar per service for low latency + central policy.
Audit logging across services
Trace ID propagates through every service. Audit log captures:
- Trace ID
- User identity
- Service chain (A → B → C)
- Resource accessed
- Decision (allowed / denied)
Forensics: query “what did user X do” returns the full cross-service chain.
Defender’s checklist
- Service mesh deployed; mTLS strict.
- Identity propagation pattern (edge token + internal token).
- Per-service authorization policy.
- OPA or equivalent for centralised policy.
- Distributed tracing with trace ID through all services.
- Audit log captures cross-service flows.
Module Quiz · 6 questions
Pass with 80%+ to mark this module complete. Unlimited retries. Each question shows an explanation.
Custom team training + practitioner advisory
Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.