Secure service-to-service communication in microservices combines encryption in transit, mutual authentication, and access control at the network and API level.
Key Points: • HTTPS/TLS encrypts data in transit so requests and responses between services can't be read or tampered with on the network. • Mutual TLS (mTLS) goes further by having both sides present certificates, so each service can verify it's really talking to the expected service, not an impostor. • An API Gateway or service mesh (like Istio) centralizes authentication, authorization, and TLS termination or mTLS enforcement so individual services don't reimplement it. • Access tokens (such as JWTs) or API keys let services and gateways verify caller identity and permissions on each request. • Network-level controls, like restricting which services can reach which others (network policies), add another layer of defense beyond application-level security.
Example: In a Kubernetes cluster running Istio, the service mesh automatically enforces mTLS between pods, while an API Gateway validates a JWT on incoming external requests before they ever reach an internal service, so both external and internal traffic are authenticated.
Interview Tip: A concise interview answer is:
"I'd secure inter-service communication with TLS for encryption, mutual TLS so services authenticate each other, and an API Gateway or service mesh to centralize enforcement instead of building it into every service. Access tokens or API keys on top of that ensure only authorized callers can invoke a given service."