How to organize secure communication between microservices?

Question

Service Oriented Architecture

I plan to divide a monolithic application into microservices that will be located on different servers.
I understand that these microservices will be available from outside (i.e. from the Internet). Therefore, the question arises:
How to organize secure communication between microservices? To accept requests only from trusted applications (that is, from my other microservices).

PS: It would be nice to make it possible to specify access for each specific method.
For example, there is a payment microservice that has 1) a method for making a payment and 2) a method for viewing the payment history. And only one specific microservice should have access to the first method, and any of my microservices should have access to the second method.

PS 2: The languages ​​in which microservices will be written are Java and NodeJS.

Answer 1

Interservice communication is no different from client-server communication. The same authentication and authorization (the same notorious openid credentials grant flow), the same SSL. In some rare cases, you can limit yourself to white-list ip, but there are enough restrictions and no roles

Answer 2

Organize a network, open a hole outward. Guides a whole car. And by the way, it's just idiocy to protect applications if your network has already been broken into. IMHO

Answer 3

I understand that these microservices will be available from outside

Only those for which it is really necessary, the rest should be inaccessible.

Answer 4

Cors for example.