aws / aws/aws-app-mesh-examples

Provide mTLS walkthrough for east-west traffic

Open
#481 0 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
Shell
Stars
868
Forks
384
PR merge metrics
No merged PRs in 30d

Description

_**Important note on security disclosures**: If you think you’ve found a potential security issue, please do not post it in the Issues. Instead, please follow the instructions [here](https://aws.amazon.com/security/vulnerability-reporting/) or [email AWS security directly](mailto:aws-security@amazon.com)._

**Describe the bug**
A clear and concise description of what the bug is.

- mTLS walkthrough's provide examples for Gateway to application mtls configuration. However, this is not end to end. Considering a application with multiple backends in same mesh, we need an mtls example to shows following,

```
gateway -> app1 -> app2
```
Note: mTLS enabled between `gateway -> app1`, `app1 -> app2`, `gateway-> app1 -> app2`

**Platform**
EKS, ECS, EC2, etc.

- EKS, ECS

**To Reproduce**
Steps to reproduce the behavior:
1. Go to [aws-app-mesh-examples](https://github.com/saiteja313/aws-app-mesh-examples/tree/main/walkthroughs)/[howto-mutual-tls-file-provided]
2. Follow instructions and deploy setup.
3. Validate that mTLS is configured from `gateway -> blue (color)` but no mTLS between `blue -> green`

**Additional context**
Add any other context about the problem here.
- We can add a note about this stating, `to enable support for east-west traffic, you can add backend listener pointing on client app pointing to server app`.

Contributor guide

Open the contributing guide

Research direction

Start with the walkthrough at walkthroughs/howto-mutual-tls-file-provided and reproduce its gateway-to-blue setup on EKS or ECS. Extend the walkthrough to cover gateway -> app1 -> app2 with mTLS on both hops, then validate that traffic between the services is encrypted and document the backend-listener configuration needed for east-west traffic.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes, shell
Domain
devops, documentation, networking, security
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.