Demo: authorizing FulfillCo services to Shop events and APIs
On This Lesson 3 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
design access for FulfillCo services to consume Shop events and call Shop APIs with least privilege; prepares SRB-016-LAB1.
Draft outline details
Step by step
- List the FulfillCo services and the Shop data and endpoints each needs.
- Assign each service a workload identity and define the allowed topics and endpoints in a matrix.
- Issue scoped, short-lived tokens or mTLS identities; define audiences and scopes.
- Planned mistake: grant a broad read scope because "they might need it later". Fix: grant exactly what is used and add a request process for more.
- Write policy tests for allow and deny cases and enable audit logging.
- Walk the review with the role-played security architect and record findings.
Check your understanding
What is the rule for scope design?
Show answer
Grant only what is needed now, with a documented route to ask for more.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.