End-to-End mTLS Architecture

End-to-End mTLS Architecture An architecture diagram generated by Archify. Client · Client Cert · Architecture component Client Client Cert CloudFront · mTLS verification · AWS Edge CloudFront mTLS verification ALB · Header forwarding · AWS Edge ALB Header forwarding Istio Gateway · Header validation · EKS Cluster Istio Gateway Header validation Service A · Envoy mTLS · EKS Cluster › Service Mesh Service A Envoy mTLS Service B · Envoy mTLS · EKS Cluster › Service Mesh Service B Envoy mTLS Service C · Envoy mTLS · EKS Cluster › Service Mesh Service C Envoy mTLS 1. mTLS 2. TLS + headers 3. TLS + headers 4. mTLS 5. mTLS 6. mTLS AWS Edge EKS Cluster Service Mesh Legend Backend Cloud Security External

Security per segment

  • • Client → CloudFront: mTLS (client certificate verification)
  • • CloudFront → ALB: TLS + certificate info headers
  • • ALB → Istio Gateway: TLS + certificate info headers
  • • Inside Istio Mesh: automatic mTLS (Envoy-to-Envoy)