I was wondering if I have a microservice called, for example, Weather, and only certain people can update certain properties around the weather such as Temperature, Precipitation, and Wind.

These certain users are mapped to the weather event, e.g.:

User1 => Temperature
User2 => Wind
User3 => Temperature
User3 => Precipitation

Should the weather microservice look after this access control list in its own domain, or is it better to have a central access control microservice that returns what user can change what weather event?

For example:

1. Access Control inside the Weather microservice:
API(Weather): /Weather/Wind/Monitors => Return all Users mapped to Wind with all their data in one call

2. Access Control as a separate microservice:
API(Weather): /Weather/Wind/Monitors =>
Call the Access Control microservice to return all UserIds mapped to Wind
Call the weather database with UserIds returned from access control to get the user data.

Pros of option 1:

  • Less latency as it does not need to call another microservice.
  • Queries are more efficient, and it is easier to sort and paginate data if it is not spread across multiple domains.

Cons of option 1:

  • Access control is coupled to its specific microservice.

Pros of option 2:

  • Easier to update access control logic.
  • Access control is decoupled from its specific microservice.
  • You can change the ACL permissions without needing to touch the weather microservice.

Cons of option 2:

  • Queries can be inefficient, for example, ids returned from the Access Control microservice need to use a possible 'contains' to receive all the relevant data, and it could be slow for a large set of ids.
  • You need to pass state to the Access Control microservice, e.g., if you want to query all wind monitors by first name, you will need to store the first name in the Access Control microservice database so you can order the id's by first name.
  • All microservices need to store mapping tables in this one ACL microservice datalayer, e.g., WeatherACLMap, SeaACLMap, PlanetACLMap.
  • This is just a simple example in place of a more complex system complex access control.

What would you recommend as the best practice around this? Can you think of other advantages and disadvantages of both systems?

  • What you should be looking for is an API gateway: softwareengineering.stackexchange.com/a/420892/425983
    – Amit
    Feb 27, 2023 at 4:32
  • Have you considered a Role-based model instead of mapping users directly to permissions? It seems that a lot of the complexity is in the need for your microservices to know about user mappings instead of just knowing which roles are associated with specific permissions. Role-Based access typically involves putting roles into the user's current "session" (For example, their token or cookie), so checking their permission wouldn't need to involve knowing their identity. Feb 27, 2023 at 11:09

1 Answer 1


I would encourage you to look at it from a completely different angle.

Micro-services are meant to be as independent from each other as ;possible. In particular if service A fails, then service B should not also fail completely as a result. Instead service B should be designed to, in the worst case, give a degraded service.

To map it to your example, the Weather service should still provide as much functionality as possible when the Access Control service is unavailable. This can be achieved the easiest if the Weather service can make the authorization decision completely based on the information that a (previously authenticated) user presents, for example in the form of a token.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.