I would create a separate protected API that has an additional header such as:
Forward-To-API: database-prod
And have that service lookup the URL and credentials in a secure database and create it's own request to the external service. Even better it could also be your audit log.
The Forward-To-API header would be stripped and the rest of the query would be passed through.
I did start out this way, but I was trying to make something that would achieve the goal without requiring any changes to my application code. Setting the HTTPS_PROXY environment variable on the app server and adding the internal CA cert to the set of trusted authorities s is all that's required to get it working now, which is nice.
The thing you've described is still a MitM (the "protected API" can still see all of the request contents on their way to the destination).
I would create a separate protected API that has an additional header such as:
And have that service lookup the URL and credentials in a secure database and create it's own request to the external service. Even better it could also be your audit log.The Forward-To-API header would be stripped and the rest of the query would be passed through.
-- This is so obvious that it must already exist!