<p>I have recently started learning and implementing istio in AWS EKS cluster. For configuring TLS for ingress gateway, I followed <a href="https://medium.com/faun/managing-tls-keys-and-certs-in-istio-using-amazons-acm-8ff9a0b99033" rel="nofollow noreferrer">this guide</a> which simply asks you to add AWS ACM ARN id to istio-ingressgateway as an annotation. So, I had to neither use certs to create <code>secret</code> nor use envoyproxy's SDS.</p>
<p>This setup terminates TLS at gateway, but I also want to enable mTLS within mesh for securing service-service communication. By following <a href="https://istio.io/latest/docs/tasks/security/authentication/authn-policy/#namespace-wide-policy" rel="nofollow noreferrer">their documentation</a>, I created this policy to enforce mTLS within a namespace:</p>
<pre><code>apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: xyz-mtls-policy
  namespace: xyz-dev
spec:
  mtls:
    mode: STRICT
</code></pre>
<p>But even after applying this, I see one service being able to call another service using <code>http</code>.</p>
<p>So my question is: how do I use the ACM certs to implement mTLS in my namespace?</p>

<p>If you're calling from inside the mesh I would say it's working fine, take a look <a href="https://banzaicloud.com/blog/istio-auto-mtls/#setting-strict-mtls-policy" rel="nofollow noreferrer">here</a> and <a href="https://banzaicloud.com/blog/istio-mtls/#mutual-tls-in-istio" rel="nofollow noreferrer">here</a>.</p>
<h2>Mutual TLS in Istio</h2>
<blockquote>
<p>Istio offers mutual TLS as a solution for service-to-service authentication.</p>
<p>Istio uses the sidecar pattern, meaning that each application container has a sidecar Envoy proxy container running beside it in the same pod.</p>
<ul>
<li><p>When a service receives or sends network traffic, the traffic always
goes through the Envoy proxies first.</p>
</li>
<li><p>When mTLS is enabled between two services, the client side and server side Envoy proxies verify each other’s identities before sending requests.</p>
</li>
<li><p>If the verification is successful, then the client-side proxy encrypts the traffic, and sends it to the server-side proxy.</p>
</li>
<li><p>The server-side proxy decrypts the traffic and forwards it locally to the actual destination service.</p>
</li>
</ul>
</blockquote>
<p><a href="https://i.stack.imgur.com/7LXQ3.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/7LXQ3.png" alt="enter image description here" /></a></p>
<hr />
<blockquote>
<p>I am on istio 1.6.8, think it enables mTLS by default.</p>
</blockquote>
<p>Yes, it's enabled by default since istio 1.5 version. There are related <a href="https://istio.io/latest/news/releases/1.5.x/announcing-1.5/upgrade-notes/#automatic-mutual-tls" rel="nofollow noreferrer">docs</a> about this.</p>
<blockquote>
<p>Automatic mutual TLS is now enabled by default. Traffic between sidecars is automatically configured as mutual TLS. You can disable this explicitly if you worry about the encryption overhead by adding the option -- set values.global.mtls.auto=false during install. For more details, refer to <a href="https://istio.io/latest/docs/tasks/security/authentication/authn-policy/#auto-mutual-tls" rel="nofollow noreferrer">automatic mutual TLS</a>.</p>
</blockquote>
<hr />
<blockquote>
<p>Is there any clear process to prove that it is indeed using mTLS?</p>
</blockquote>
<p>I would say there are 3 ways</p>
<ul>
<li>Test with pods</li>
</ul>
<p>You can change it from strict to permissive and call it from outside the mesh, it should work. Then change it to strict and call it again, it shouldn't work. In both ways you should be able to call it from a pod inside the mesh.</p>
<ul>
<li>Kiali</li>
</ul>
<p>If you want to see it visual way kiali should have something like a padlock when mtls is enabled, there is <a href="https://github.com/kiali/kiali/issues/2381" rel="nofollow noreferrer">github issue</a> about that.</p>
<p><a href="https://i.stack.imgur.com/3auEo.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/3auEo.png" alt="enter image description here" /></a>
<a href="https://i.stack.imgur.com/df2HG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/df2HG.png" alt="enter image description here" /></a></p>
<ul>
<li>Prometheus</li>
</ul>
<p>It was already mentioned in the banzaicloud, and you mentioned that in the comments, you can check the Connection Security Policy metric label. Istio sets this label to mutual_tls if the request has actually been encrypted.</p>
<hr />
<p>Let me know if have any more questions.</p>
