Zero Trust Security for Microservices

"Inside the VPC" is not a trust boundary. Zero trust assumes breach—every service proves identity, every call is authorized, every network path is least-privilege.

mTLS between services

• Issue short-lived certificates via service mesh or SPIFFE
• NestJS services trust client certs presented by sidecars
• Rotate CAs with overlap windows—hard cutovers cause outages

Network policies

# Only blog-service may reach media-service:3000
egress:
  - to: media-service
    ports: [3000]

Default deny between namespaces; explicit allow per consumer.

Identity beyond IP

Gateway JWT validation is edge zero trust; internal calls use service accounts mapped to RBAC roles. No shared internal-api-key across ten services.

Secrets and blast radius

Compromised worker pod should not read payment DB credentials. Namespace-scoped secrets and policy enforcement contain lateral movement.

Zero trust is incremental—start with mTLS on highest-risk data paths, expand as tooling matures.