The private service that wasn't
The billing service should only ever be called by other services inside the network. It was deployed behind a public load balancer with an IP allow-list, because that was quick and it worked.
Allow-lists drift. A new NAT address, a new region, a rushed change during an incident — and now billing is answering the internet.
Give the public API a way to reach billing that never leaves the private network.
Components — tap one, then tap a slot on the diagram
!Billing is answering requests from the internet. It was never meant to.
Boundaries, outermost first: VPC: Public API (internet-facing) Private subnet: Billing (internal only; FAILED: exposed), an empty slot for the service-to-service Outside every boundary: Internet Connections: Internet calls Public API — HTTPS (step 1) Public API calls service-to-service — east-west (step 2) service-to-service calls Billing (step 3) Internet must NOT reach Billing — no public path exists
Internet
Public APIinternet-facing
Billinginternal onlyexposed