Fully-managed secure connectivity among constituent services of distributed applications

1 . A system, comprising:

a control plane server of an application management service of a cloud computing environment; and

a plurality of container execution resources, including a first container execution resource and a second container execution resource;

wherein the control plane server is configured to:

obtain, from a client of the application management service, a programmatic indication that (a) a plurality of constituent services of an application of the client is to be executed using at least the plurality of container execution resources, (b) connectivity between individual constituent services of the plurality of constituent services is to be established using Transport Layer Security (TLS), without obtaining networking information of the individual constituent services from the client and (c) digital certificates for establishment of TLS connections among pairs of constituent services of the plurality of constituent services are to be obtained and rotated automatically by the application management service;

propagate, to a first connectivity agent established by the application management service at the first container execution resource without receiving a request from the client to establish the first connectivity agent, a first digital certificate assigned by the control plane server to a first constituent service of the plurality of constituent services of the application for establishment of connections between the first constituent service and one or more other constituent services of the application, wherein the first digital certificate is generated by a certificate authority at the request of the control plane server, wherein the first digital certificate is propagated to the first connectivity agent during an initialization phase of the first connectivity agent prior to initiation of communication between a first program implementing the first constituent service within a first container at the first container execution resource and other programs implementing other constituent services of the application;

in response to determining that a criterion for automated certificate rotation has been satisfied by the first constituent service, propagate, to the first connectivity agent, a second digital certificate assigned by the control plane server to the first constituent service, wherein the second digital certificate is generated by the certificate authority at the request of the control plane server; and

wherein the first connectivity agent at the first container execution resource is configured to:

establish, using the first digital certificate, prior to receiving the second digital certificate, a first TLS connection with a second connectivity agent at the second container execution resource;

transmit, via the first TLS connection, to the second connectivity agent, one or more messages generated at the first program and directed to a second program implementing a second constituent service of the plurality of constituent services at a second container on the second container execution resource;

establish, using the second digital certificate, after receiving the second digital certificate, a second TLS connection with the second connectivity agent at the second container execution resource; and

transmit, via the second TLS connection, one or more messages generated at the first program and directed to the second program.

2 . The system as recited in claim 1 , wherein the control plane server is further configured to:

obtain, from the client, an indication of the certificate authority.

3 . The system as recited in claim 1 , wherein the certificate authority is implemented at a private certificate authority service of the cloud computing environment.

4 . The system as recited in claim 1 , wherein to propagate the first digital certificate to the first connectivity agent, the control plane server is further configured to:

cause an encrypted version of the first digital certificate to be transmitted to the first connectivity agent.

5 . The system as recited in claim 1 , wherein the first container execution resource comprises one of: (a) a compute instance of a virtualized computing service of the cloud computing environment or (b) a server located at a premise external to the cloud computing environment.

6 . A computer-implemented method, comprising:

obtaining, at a control plane server of a network-accessible service of a cloud provider network, from a client, an indication that security artifacts used for establishment of connections among constituent services of a plurality of constituent services of an application are to be obtained automatically by the network-accessible service, without receiving input pertaining to individual security artifacts from the client;

transmitting, by the control plane server to a first connectivity agent established at a first execution resource, a first set of security artifacts assigned by the control plane server to a first constituent service of the plurality of constituent services of the application for establishment of connections between the first constituent service and one or more other constituent services of the application, wherein the first set of security artifacts is generated by an artifact source at the request of the control plane server, and wherein at least a portion of the first constituent service is run at the first execution resource;

establishing, by the first connectivity agent using at least the first set of security artifacts, a network connection with a second connectivity agent at a second execution resource at which at least a portion of a second constituent service is run; and

transmitting, by the first connectivity agent to the second connectivity agent via the network connection, one or more messages generated at the first constituent service and directed to the second constituent service.

7 . The computer-implemented method as recited in claim 6 , wherein the first set of security artifacts comprises a digital certificate.

8 . The computer-implemented method as recited in claim 6 , further comprising:

obtaining, at the control plane server from the client, an indication of the artifact source.

9 . The computer-implemented method as recited in claim 6 , wherein the artifact source comprises a private certificate authority configured by the client.

10 . The computer-implemented method as recited in claim 6 , further comprising:

causing, by the control plane server, at least one artifact of the first set of security artifacts to be encrypted prior to transmission of the first set of artifacts to the first connectivity agent.

11 . The computer-implemented method as recited in claim 6 , further comprising:

obtaining, by the control plane server from the client, an identifier of a key to be used to encrypt at least a particular artifact of the first set of security artifacts; and

causing, by the control plane server, the particular artifact to be encrypted using the key, without obtaining the key at the control plane server.

12 . The computer-implemented method as recited in claim 6 , further comprising:

obtaining, by the control plane server from the client, an indication of an encryption algorithm to be employed for messages transmitted between the first constituent service and other constituent services of the application; and

causing, by the control plane server, the encryption algorithm to be employed by the first connectivity agent with respect to the one or more messages.

13 . The computer-implemented method as recited in claim 6 , further comprising:

causing, by the control plane server, an encrypted version of a particular security artifact of the first set of security artifacts to be stored, using an account of the client, at a secrets management service, wherein the encrypted version of the particular security artifact require one or more keys of the client for decryption, wherein the one or more keys are not accessible to the control plane server, and wherein transmitting of the first set of security artifacts to the first connectivity agent comprises transmitting the encrypted version of the particular security artifact to the first connectivity agent.

14 . The computer-implemented method as recited in claim 6 , further comprising:

in accordance with an artifact rotation policy,

obtaining, by the control plane server, a second set of security artifacts from the artifact source; and

transmitting, by the control plane server, the second set of artifacts to the first connectivity agent.

15 . The computer-implement method as recited in claim 14 , further comprising:

obtaining the artifact rotation policy by the control plane server from the client.

16 . A non-transitory computer-accessible storage medium storing program instructions that when executed on a processor:

obtain, at a control plane server of a network-accessible service of a cloud provider network, from a client, an indication that security artifacts used for establishment of connections among constituent services of a plurality of constituent services of an application are to be obtained automatically by the network-accessible service, without receiving input pertaining to individual security artifacts from the client;

transmit, by the control plane server to a first connectivity agent established at a first execution resource, a set of security artifacts assigned by the control plane server to a first constituent service of the plurality of constituent services of the application for establishment of connections between the first constituent service and one or more other constituent services of the application, wherein the set of security artifacts is generated by an artifact source at the request of the control plane server, and wherein at least a portion of the first constituent service runs at the first execution resource;

establish, by the first connectivity agent using at least the set of security artifacts, a network connection with a second connectivity agent at a second execution resource at which at least a portion of a second constituent service of the plurality of constituent services runs; and

transmit, by the first connectivity agent to the second connectivity agent via the network connection, one or more messages generated at the first constituent service and directed to the second constituent service.

17 . The non-transitory computer-accessible storage as recited in claim 16 , wherein the set of security artifacts comprises a digital certificate.

18 . The non-transitory computer-accessible storage as recited in claim 16 , storing further program instructions that when executed on the processor:

obtain, at the control plane server from the client, an indication of the artifact source.

19 . The non-transitory computer-accessible storage as recited in claim 16 , storing further program instructions that when executed on the processor:

cause, by the control plane server, at least one artifact of the set of security artifacts to be encrypted prior to transmission of the set of artifacts to the first connectivity agent.

20 . The non-transitory computer-accessible storage as recited in claim 16 , storing further program instructions that when executed on the processor:

obtain, by the control plane server from the client, an identifier of a key to be used to encrypt at least a particular artifact of the set of security artifacts; and

cause, by the control plane server, the particular artifact to be encrypted using the key, without obtaining the key at the control plane server.