Applying Fine-Grained Authorization Policies

You will create identity-based access control rules to restrict which services are allowed to communicate with specific sensitive endpoints.

In this lesson, you will learn how to transition from "allow-all" networking to a Zero Trust architecture by applying fine-grained authorization policies within your service mesh.

By default, even with mutual TLS (mTLS) enabled, any service in your cluster can communicate with any other service. While mTLS ensures the identity of the sender, it doesn't automatically restrict what that sender is allowed to do. To achieve true least-privilege access, we use AuthorizationPolicy resources to explicitly whitelist which services can call specific endpoints.

Defining Authorization Rules

An AuthorizationPolicy allows you to define access rules based on the identity of the workload (using its service account) and the specific HTTP methods or paths being accessed.

For example, if you have a frontend service that should only be allowed to make GET requests to the catalog service, you would define a policy like this:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: allow-frontend-to-catalog
  namespace: default
spec:
  selector:
    matchLabels:
      app: catalog
  action: ALLOW
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/default/sa/frontend-sa"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/products/*"]

Why This Matters

When you apply this policy, the Istio sidecar proxy intercepts every incoming request to the catalog service. If the request comes from a service other than frontend—or if the frontend tries to send a POST request to modify the database—the proxy will immediately reject it with a 403 Forbidden response.

This granularity is essential for sensitive endpoints. By restricting access to internal APIs, administrative dashboards, or PII-handling services, you significantly reduce the "blast radius" if one of your front-facing containers is ever compromised. You are moving beyond simple connectivity to controlling the logical interactions between your microservices.

Key Takeaway: Fine-grained authorization policies enforce the principle of least privilege by restricting service-to-service communication to only the specific identities, methods, and paths required for legitimate business operations.