title: How to enable automatic mTLS using istio mesh in AWS EKS?
body: <p>I have recently started learning and implementing istio in AWS EKS cluster. For configuring TLS for ingress gateway, I followed <a href="https://medium.com/faun/managing-tls-keys-and-certs-in-istio-using-amazons-acm-8ff9a0b99033" rel="nofollow noreferrer">this guide</a> which simply asks you to add AWS ACM ARN id to istio-ingressgateway as an annotation. So, I had to neither use certs to create <code>secret</code> nor use envoyproxy's SDS.</p>
  <p>This setup terminates TLS at gateway, but I also want to enable mTLS within mesh for securing service-service communication. By following <a href="https://istio.io/latest/docs/tasks/security/authentication/authn-policy/#namespace-wide-policy" rel="nofollow noreferrer">their documentation</a>, I created this policy to enforce mTLS within a namespace:</p>
  <pre><code>apiVersion: security.istio.io/v1beta1
  kind: PeerAuthentication
  metadata:
    name: xyz-mtls-policy
    namespace: xyz-dev
  spec:
    mtls:
      mode: STRICT
  </code></pre>
  <p>But even after applying this, I see one service being able to call another service using <code>http</code>.</p>
  <p>So my question is: how do I use the ACM certs to implement mTLS in my namespace?</p>