I am working on Spring Boot Microservices project, asking one doubts mainly from the security perspective between inter-service communication. In my project we've API Gateway which screen all incoming requests for security issues before routing them to the appropriate microservices. The API gateway sits between the client applications and the microservices. It then limits exposing the microservices while providing additional request management functions such as authentication, SSL termination, protocol translation, monitoring, request routing, caching, and more.
Assume Case Microservice1(MS1) >> Microservice2(MS2) >> Microservice3(MS3), since the authentication and Authorizations are happening at API GW layer, then how can we provide security to interservice communication? What if someone directly calls MS2 or MS2 endpoints directly?
Dept answer is anticipated here.