Securing Microservice APIs

Chapter 3. A General Approach to Microservice API Security

The variety of current approaches to API access control in a microservices context underlines the complexity involved. Although the solutions outlined in Chapter 2 are useful, there is not yet a cross-platform approach that covers all of the requirements from Chapter 1. This chapter proposes a generalized approach to microservice API access control—Domain Hierarchy Access Regulation for Microservice Architecture (DHARMA)—that incorporates and accounts for the variety of solutions.

Common Patterns in Microservice API Security Solutions

In theory, a singular approach could be taken to protecting every API endpoint in a microservice architecture, with maximum security using a “zero trust” mentality. However, in practice, we have already seen how networks, cryptography, credentials, tokens, and platforms are all being used to provide varying degrees of access control. Why is this?

As discussed earlier, microservice architecture is employed to help organizations optimize their software delivery speed and system stability while scaling up. Distributed or decentralized organizations have recognized that a one size does not fit all when it comes to administering API security policies and enforcing those policies efficiently at runtime. This continuous need for optimization has led to the diversity of microservice API security solutions. Yet there are still common patterns in the heterogeneity.

Each of the solutions in Chapter 2 ...