policy.rego

package envoy.authz

import input.attributes.request.http as http_request

default allow = false

# allow Frontend service to access Database service
allow {
    http_request.method == "GET"
    svc_spiffe_id == "spiffe://acme.com/frontend"
}

svc_spiffe_id = client_id {
    [_, _, uri_type_san] := split(http_request.headers["x-forwarded-client-cert"], ";")
    [_, client_id] := split(uri_type_san, "=")
}