We have a micro-services architecture, where many microservers need to talk to each other for data.

These services are inside a VPC.

I need to understand if the HTTP APIs of these microservices need not have any authentication if they are no active clients(mobile and web) talking to/connected to these services.

Our current worry is, that if a system inside gets compromised, the attacker can get access to all the systems if leaving the services to be authentication less.

Note: These services are connected to the Internet via NAT gateway, so one way communication can happen if the services want to make an API call to third parties.

1 Answer 1


Your worry isn't wrong.

If an attacker was inside the VPC for some reason (remote code execution on a server inside the VPC, hacked admin account, etc) they would have unfettered access to other systems if they are left unauthenticated.

This is the concept of defense in depth. Even if one security control is circumvented, there should be others to prevent total control.

  • Thanks for writing this down! It's helpful. I am not a security expert, I would like to know all the ways that someone can enter VPC. Where is a good place to research this? May 27, 2022 at 13:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .