I have a website that’s built like this:

Server 1: Frontend & API1.

Server 2: API2.

Server 3: API3.

The frontend and the APIs each have their own separate app pool, so there’s 4.
All the app pools have the same identity account: MyDomanMyAccount

API3 is the most important one, is the last one reached after a request, and its the one that does all the work with sql databases and also generates excel and pdf files on the same folder it’s hosted. By that i mean there’s a “PDFs” and “ExcelFiles” folder in the same place the .exe for API3 is.

API1 & API2 are there mostly for security reasons, they just recieve the request from the frontend and then send it to API3.

The flow when a request is made is: Frontend > API1 > API2 > API3

I know the requests go through 3 different servers but what i want to know is: Could i leave the default AppPoolIdentity for all the app pools except the one for API3 since that’s the one that needs to consult the db and create files? If i do that i that server 1 and server 2 would have their own “virtual” identities that may only have read permissions, but since all the work is done with API3 inside Server 3 i believe there would be no issue in doing this.

Am i right or does all of this sound too farcical? I’ve just entered a new job and i inherited and app like this and i noticed this issue with the accounts in the app pools, and since i dont really know too much about IIS and app pools i want to see if this could be possible.