We have a micro-services architecture, where many microservers need to talk to each other for data.
These services are inside a VPC.
I need to understand if the HTTP APIs of these microservices need not have any authentication if they are no active clients(mobile and web) talking to/connected to these services.
Our current worry is, that if a system inside gets compromised, the attacker can get access to all the systems if leaving the services to be authentication less.
Note: These services are connected to the Internet via NAT gateway, so one way communication can happen if the services want to make an API call to third parties.