CODEWITHSUNDEEP
azureamazon-web-servicesopenidadalazure-active-directory
Omer Levi Hevroni
Omer Levi Hevroni

Reputation: 1997

Service to service authentication in AWS - what are the best practices?

At the firm I am working currently, we have a lot of microservices, currently, most of them are deployed to Azure. In Azure, service to service authentication is simple: Azure Active Directory is an authorization server, and the service can request OAuth 2 tokens from it using either client credentials or client assertion (with JWT) flow. Then, the service can use this token to authenticate to other services.

In the last few months, we started moving some of our services to AWS. And this makes me wonder - is there an alternative to Azure Active Directory? I could not find something myself, so I thought it is better to ask: What is the recommended way to implement service to service authentication outside Azure? I know you can use Azure Active Directory also outside Azure. I am asking that because I guess there must be other tools out there, maybe with easier integration with AWS.

I didn't mention any programming language (we are using mainly C# here, and a little NodeJS recently) because I feel this question is language-agnostic - I will prefer solution that works well with many languages.

Thank you,

Omer

Upvotes: 2

Views: 2030

Answers (2)

Alex Fux
Alex Fux

Reputation: 21

Amazon has AWS Directory Service. It's Microsoft AD in AWS Cloud.

Upvotes: 2

Bram
Bram

Reputation: 4532

I wouldn't know of any AWS services that'll help you with that exact use-case. However, you could solve this by exposing two ports in the application; one for internal requests and one for external. You can use security groups to shield off the internal port for requests from the internet.

Another option that might involve more changes to your setup is to use a gateway. This pattern is used a lot for microservices, an elaborate description can be found e.g. here. The basic concept is that all outside (internet) requests go through a gateway service that allows certain routes and disallows certain other routes. In cases where users have to login, the gateway will usually handle the authentication.

Upvotes: -1

Related Questions