posix_monad

Services often need to talk to each-other, but how should they control access?

In an ideal world, callers can prove who they are to services and services only grant access to a minimal set of consumers. There should be low boiler-plate for maintaining service identities and things like token revocation, secret rotation, etc. should be "easy". Bonus points for avoiding vendor lock-in.

What approach do you use for securing service-to-service access?

We want to keep our databases secure, but sometimes developers need access (think migrations, debugging, business information queries).

Ideally, database access is:

- Connected to existing developer authentication (single sign-on)

- Time limited

- Requires approval

- Leaves an audit trail

How do you achieve these conflicting goals?

Some approaches:

- Put the database in a public subnet and give developers database credentials. This is strongly discouraged by AWS etc (why?). No audit trail or approvals process.

- Put the database in a private subnet with a VPN in a public subnet. Give developers database credentials. This requires credential management for the VPN and you need to pay for an additional server. Access is not time limited. No audit trail or approvals process.

- Something else... ?