Question

A financial services company is deploying a new payments platform as dozens of microservices on Amazon ECS with AWS Fargate across multiple Availability Zones. Compliance requires that all service-to-service traffic be encrypted in transit with mutual authentication (mTLS), that certificates rotate automatically without redeploying containers, and that the security team can centrally observe and enforce which services may communicate. The team wants to minimize custom code inside each service. Which approach best meets these requirements?

Accepted Answer

Use AWS App Mesh with the Envoy proxy sidecar integrated with AWS Private CA to issue and automatically rotate certificates, enabling mTLS and centralized traffic policy for service-to-service communication.

Answer

Terminate TLS at an Application Load Balancer per service using ACM certificates, and rely on VPC security groups to control which services can reach each other.

Answer

Embed a TLS library in each microservice, store long-lived certificates in AWS Secrets Manager, and have each service validate peer certificates on every request.

Answer

Place all microservices in a single private subnet, enable VPC flow logs for observability, and encrypt the underlying EBS/EFS volumes with AWS KMS.