Microservice architecture composes an application from smaller services that communicate through networked APIs. Each service boundary creates another exposed entry point, so authorization must remain consistent across the service graph. section 11.0 section 11.1
From one guarded door to many
ACME split a Customer Collaboration monolith into document, search, and notification services; HR and Finance created additional APIs. A request such as a manager retrieving a project report could cross a dozen APIs, whose inconsistent checks made authorization fragmented and brittle. section 11.1
Common enforcement placements include:
- An API gateway centralizes enforcement for selected inbound traffic. section 11.1
- A service mesh applies enforcement across service-to-service communication. section 11.1
- Per-service proxies protect critical APIs close to individual services. section 11.1
