In my microservice architecture, I currently have a user API Gateway, a balance microservice and a balance DynamoDB.
I have configured DynamoDB with some fine-grained access and constraint so that my balance microservice can only modify the balance down and not up.
I wish to add an admin API Gateway that will call the same balance microservice, and in that case, the microservice must be able to modify the balance up.
My goal here is that if the microservice gets compromised through SQLi, RCE, dep vulnerability etc, it can't modify the balance up. But using the same microservice, an admin could. Is something like that possible ? For example, a way to sign a message from the admin API gateway and get DynamoDB to verify that signature and allow balance modification if it is valid but I didn't find any way to do that.