What are they?
Backend cloud services are the operations and routines end users don’t see but are essential to provide resilience and secure access to backend services and resources.
The Problem:
In simple terms the backend services in AWS or within a cloud deployment should allow our frontend services to power up user interfaces and scale to meet user demands. Backend services should also include collating, analysing and sending requested data, meaning telemetry and logging.
The Mesh:
A mesh is a networking convention which is often referred to as east-west traffic management, and the securing of east-west traffic within a platform. This is a key concern when deploying complex scalable systems, usually based on containers, Kubernetes infrastructure and related micro-services.
A service mesh is a way to control how different parts of an application share data with one another. It is also a dedicated infrastructure layer built into an app. Istio is an open-source service mesh, and the major cloud providers have all built their managed offerings. With service meshes, you can manage, observe and secure services without having to change service credentials. They can reduce or eliminate the need to manage service accounts at all.
The AWS App Mesh can manage and monitor microservices. This service offers users control of the communication and network traffic targeting those microservices. When the cloud handles mundane but critical administrative duties of backend services, IT departments and business units are free to take on more involved tasks.
Part of Security:
Meshing and network management is a part of our security posture. We need to secure the storage and distribution of access keys, to operate with the principle of least privilege and to safeguard inter-service communications. By restricting access to a cloud environment, an organization can lower its security risks.
When it comes to digital security in the cloud, there are some key terms to know and understand:
Managing access to backend services
When building back-end systems and services that need to scale some best practices include:
Cloud platforms offer innovations
Most cloud platforms enable users to manage credentials and observe and secure services without changing access keys. Important strategies for securing services and minimizing outages include using an automated certificate management tool, auditing access to services, time-bound access for on-call engineers, and secure key storage.
On AWS, AWS Secrets Manager enables users to rotate, manage and retrieve database credentials, API keys and other secrets through their lifecycle. Temporary security credentials can be configured to expire after a few minutes or several hours.
Managing it all
Managing backend cloud services with the help of providers such as Google, AWS and Microsoft Azure can mean making frontend services appear to be seamless and reliable. There is complexity in password rotations and security certificate expiration dates. Mutual authentication using private certificates can help. Cloud-managed PKI certificates can simplify administrative security tasks. For companies that can use microservices, service meshes can manage much of the infrastructure.
