How to authenticate between Merritt apps

[terrywbrady]

Discussed with IAS on 5/3. IAS will raise the question to Colin and to the AWS reps.

Question: what is an AWS best practice for securing trust between microservices?

• Use SSL and share secret strings in headers
• Use a WAF to ensure trust (requires a load balancer to be in place)
  • What about direct calls to a specific instance (such as running a state command to check on a specific instance)?
  • We have a couple of other specific cases where we direct requests to a single instance rather than using a load balancer.
• Martin suggested API gateway + WAF + ACM certificate
• How can we implement this with minimal changes to application code?

Background

• Merritt consists of
  • 1 rails application
  • 8 java micro services running inside tomcat
  • Some have load balancers/some do not
  • RDS
  • Cloud storage
  • Zookeeper for queuing

Todo for Merritt

• Define tiers of access
  • state command / build info
  • accessible to the entire CDL network
  • GET requests
  • accessible to CDL network with ??? (additional check)
  • POST/PUT/DELETE requests
  • higher scrutiny

[terrywbrady]

Martin researched "zero trust microservices".

Options to consider.

• Have services share JWT header (shared secrets) to authenticate
• AWS App Mesh - seems complicated

[terrywbrady]

I found this to be more useful:

https://jaxlondon.com/blog/zero-trust-with-microservices-its-easier-than-you-think/

And finally, one of the pages Jim referenced mentions AWS App Mesh, which you can learn about here: https://aws.amazon.com/app-mesh

I'll close this ticket for now, but if Kevin happens to chime in I'll add his response.

--Martin

[terrywbrady]

Per our brief conversation, you might find these docs of interest:

https://docs.aws.amazon.com/whitepapers/latest/microservices-on-aws/microservices.html

https://docs.aws.amazon.com/whitepapers/latest/microservices-on-aws/service-discovery.html

Since we were talking generally, it is hard to detail. So, the latter link, is focused on a Kubernetes environment. Another approach is to use Lambda for your code, which then you could keep that within your VPC and talk to service endpoints via Private Link, if necessary for service connections.

So, this is a bit variable depending on your direction.

Let me know your thoughts on these approaches – or if you have more detail on how the development team will progress with code in the future

Also, let me know if this does not quite address your question.