Best practices for securing service to service REST communication in a microservices architecture

Question

Hi all,

With so many options available ((API Gateway REST API, HTTP API,  ALB ) I'm looking for best practices regarding internal service to service communication in a micro service architecture.

Specific questions I have:

* Which load balancing service to choose when for internal service-to-service communication (API Gateway REST API, HTTP API,  ALB)?
* What is a best practice for securing internal microservices (just by IP range or OIDC) ?

Accepted Answer

There are multiple considerations when building microservices. What is a good fit depends on your use case, for instance do you run servers or serverless, is service discovery needed, are the services sync or async in nature or mix - best practice can be different depending on the needs.

I would recommend to read this white paper we have on microservices on AWS https://d1.awsstatic.com/whitepapers/microservices-on-aws.pdf. It will give good overview and lots of context how to approach microservices on AWS.

Best practices for securing service to service REST communication in a microservices architecture

관련 콘텐츠