Cloud Native Data Security with OAuth

Chapter 3. Security Architecture

A good approach for an API security architecture combines the principle of separation of concerns with open standards. This way, the security architecture can scale and mature over time and you can extend it with additional functions or services when needed.

This chapter introduces a cloud native security architecture for APIs that combines identity management, API management, and entitlement management with the help of the OAuth 2.0 protocol. It provides a conceptual overview of the components involved and what you need to consider when implementing API security in a cloud native environment.

What Is an API Security Architecture?

An API security architecture describes the techniques that protect APIs. In a nutshell, an API security architecture defines how to secure access to APIs and the data they expose. As with buildings, you need a good foundation for building an architecture. You need to continuously maintain the architecture throughout the API lifecycle, from design, development, and testing to deployment and retirement. Even if it may not be your primary focus, you need to consider things like secure software development and deployment processes, network and transport security, or server security for your overall API security. We assume that you take care of such aspects when implementing an API security architecture.

Securing access to APIs means that you ensure that only the callers that are entitled to access APIs (data) are allowed ...