concept opa in category microservice

This is an excerpt from Manning's book Microservices Security in Action. Login to get full access to this book.

In this section, we look at controlling access to the Order Processing microservice by using Open Policy Agent (OPA) at the API gateway. The API gateway here is acting as a policy enforcement point. OPA is a lightweight general-purpose policy engine that has no dependency on microservices. You can use OPA to define fine-grained access-control policies and enforce those policies at different places in a microservices deployment.

Figure 5.13 Sequence of events that happens when an API gateway intercepts client requests to apply authorization policies using OPA