How do you secure service-to-service communication (mTLS, zero-trust)?

Question

Accepted Answer

Inside a microservices network you can't trust the network just because it's "internal." **Zero-trust** assumes the network is hostile, so every call is authenticated and authorized, and traffic is encrypted with **mTLS**.

## Mutual TLS (mTLS)

Unlike normal TLS, **both** sides present certificates. Each service proves its identity, and traffic is encrypted in transit.

```text
Service A ──cert──▶ Service B
Service A ◀─cert── Service B   (both verify each other's identity)
→ caller is authenticated AND data is encrypted
```

A service mesh can provide mTLS automatically with no app code changes.

## Service-to-service authorization

Identity (who is calling) plus policy (what they may do). Tokens (JWT) or SPIFFE identities carry the caller's identity.

```yaml
# allow only the orders service to call payments
policy:
  from: { service: orders }
  to:   { service: payments, path: /charge }
  action: ALLOW            # everything else denied by default
```

## Defense in depth

```text
✓ Authenticate every request (no implicit network trust)
✓ Least privilege — a service can call only what it needs
✓ Short-lived, rotated credentials/certs
✓ Validate tokens at the edge AND between services
✓ Encrypt in transit (mTLS) and at rest
```

## Pitfall

Trusting the internal network ("it's behind the firewall") is how a single breached service becomes a full compromise.

## Why it matters

In a flat internal network, one compromised service can otherwise reach everything; zero-trust contains that blast radius.

mTLS plus per-call authorization means an attacker who lands inside still can't impersonate services or move laterally, which is the core security promise of a modern microservices platform.