A city’s fees microservice must call the ledger microservice with authenticated identity and must not share end-user passwords between services. Which pattern fits?
Select an answer to reveal the explanation.
Short Explanation
Microservices should flash their own work badges—IAM SigV4, mTLS, or a token handoff—not pass around a citizen’s password like a sticky note. Private subnets help, but they are not an identity. Client secrets are not a password stand-in either.
Full Explanation
Cross-service authentication in microservice architectures uses service credentials or tokens (for example SigV4 with IAM roles, mutual TLS, or OAuth/OIDC token exchange) rather than end-user passwords. Sharing user passwords or treating app-client secrets as Bearer passwords is incorrect. Network isolation reduces exposure but does not authenticate the caller. DVA-C02 expects developers to wire service-to-service auth without collapsing it into IAM user administration.