What is a microservices architecture?
A microservices architecture builds an application from many small services instead of one large program. An online store might run separate services for accounts, catalog, cart, payments, shipping and reviews, each with its own codebase, its own data store and its own release schedule. They communicate over the network through APIs, typically REST over HTTP or gRPC, and through message queues. The services usually run in containers managed by an orchestrator such as Kubernetes, so each one can be scaled, updated or rolled back without touching the others.
Microservices vs. a monolith
In a monolithic application every feature runs in one process, and using another feature is a function call in memory. In microservices that call becomes a network request, which changes the security picture:
| Monolith | Microservices | |
|---|---|---|
| Attack surface | One application, few entry points | Many APIs and many network paths |
| Blast radius of a flaw | Often the whole application and its database | Can be confined to one service and its data |
| Patching | Redeploy everything | Update one service at a time |
| Investigation | One set of logs | One request may cross many services, so tracing is needed |
Securing service-to-service traffic
Requests from users, called north-south traffic, normally enter through an API gateway that authenticates callers, enforces rate limits and validates input. The calls services make to each other, east-west traffic, never pass that gateway. The classic mistake is trusting any request that starts inside the cluster, which lets an attacker who compromises one minor service call all the others. The fixes give every service an identity and check it on each call:
- Mutual TLS (mTLS): both ends present certificates, which encrypts the traffic and tells each side exactly which service is on the other end.
- Service mesh: tools such as Istio and Linkerd place a proxy beside each service to handle mTLS, certificate rotation and access policy without changing application code.
- Short-lived signed tokens: a calling service presents a token, for example one issued through the OAuth 2.0 client credentials flow, and the receiving API validates who issued it, who it is for, when it expires and what it permits.
- Per-call authorization: identity alone is not enough. The inventory service should accept stock adjustments only from the order service.
Example: a lateral call that should fail
An attacker exploits a deserialization flaw in the product-reviews service and, from inside the cluster, sends GET /internal/customers/export to the customer service. With implicit trust, the customer service answers, because the request came from an internal address. With mTLS and an allow policy that lets only the support and billing services call that path, the request is refused with HTTP 403 and logged with the caller's service identity, which also tells responders which service was compromised.
Other microservices controls
- Give each service its own credentials and database permissions, never a shared admin login.
- Validate input from other services as carefully as input from the internet.
- Scan container images and dependencies, and keep an inventory of every service and API, including old versions still running.
- Use correlation IDs and distributed tracing so one user request can be followed across services.
- Apply microsegmentation or network policies so each service can reach only the peers it needs.
Microservices on the CompTIA Security+ exam
Microservices are one of the architecture models compared in SY0-801 objective 3.1. Scenario wording such as independently deployed services that call each other's APIs describes them, and the security focus is authenticating and authorizing every service-to-service call, typically with mTLS or a service mesh, plus an API gateway for inbound traffic. A perimeter firewall is the usual wrong answer for an attack between services, since east-west traffic never crosses it. Do not confuse microservices with serverless, which is about how code is run and billed, or with microsegmentation, which is a network control that can protect either.