Building a Service Mesh with AWS App Mesh - Controlling and Observing Microservice Communication
Learn how to declaratively configure canary deployments, retry policies, and mTLS encryption using Envoy sidecars, and visualize service dependencies with X-Ray integration (AWS discontinued support for App Mesh on September 30, 2026).
Overview of App Mesh and Service Discontinuation
App Mesh was a service mesh that controlled and monitored communication between microservices. It deployed an Envoy proxy as a sidecar alongside each service, routing inter-service traffic through the proxies. Without modifying application code, you could configure traffic weighting, retries, timeouts, and circuit breakers. However, AWS stopped accepting new customers on September 24, 2024, and ended support for App Mesh on September 30, 2026. For new projects, do not adopt App Mesh; instead choose ECS Service Connect or Amazon VPC Lattice.
Traffic Control and Observability
Virtual routers let you configure traffic weighting for canary deployments, such as routing 10% of traffic to a new version. By gradually adjusting the weights (10% to 25% to 50% to 100%), you can safely migrate traffic. Retry policies allow you to declaratively define settings like retrying up to 3 times on HTTP 503 errors with exponential backoff. Circuit breakers use outlier detection to temporarily remove endpoints from the routing pool when their error rate exceeds a threshold. When X-Ray integration is enabled, Envoy proxies send trace data, visualizing call chains, latency, and error rates between services. CloudWatch metrics let you monitor request counts, latency, and error rates on a per-service basis.
mTLS and Access Control
App Mesh could encrypt communication between Envoy proxies using mTLS. When you configure certificates issued by AWS Private CA on virtual nodes, mutual authentication occurs during the proxy handshake, preventing impersonation. SDS (Secret Discovery Service) also automates certificate rotation. For access control, you explicitly define which services are allowed as backends for virtual nodes, blocking unintended inter-service communication. Envoy access logs can be sent to CloudWatch Logs to audit which services accessed which endpoints.
App Mesh Pricing and Optimization
App Mesh itself incurred no additional charges. Costs depend on the computing resources (CPU and memory) consumed by the Envoy proxies. Since they run as sidecars in ECS tasks or EKS Pods, it is important to properly size the resources allocated to the proxy in your task definition. AWS recommends allocating 512 CPU units and at least 64 MiB of memory to the Envoy container, and the allocation can be increased if higher load leaves it short of resources. When enabling X-Ray tracing, trace data storage costs apply, so adjust the sampling rate to balance cost and observability.
Migration Targets - ECS Service Connect and VPC Lattice
AWS recommends two migration targets from App Mesh: ECS Service Connect and Amazon VPC Lattice. ECS Service Connect specializes in inter-service communication within ECS and, like App Mesh, is Envoy-based but with simplified control plane configuration. Virtual node and virtual router definitions are unnecessary; simply adding serviceConnectConfiguration to your ECS service definition enables service discovery, load balancing, and retries. VPC Lattice, on the other hand, provides inter-service communication across VPC boundaries, routing across different compute types including ECS, EKS, Lambda, and EC2. It requires no sidecar proxies like Envoy; joining a VPC Lattice service network establishes connectivity, reducing operational overhead. As a selection criterion, use Service Connect for communication confined within ECS, and VPC Lattice for multi-VPC or multi-account scenarios spanning heterogeneous compute types.
Migration Design Decisions and Considerations
The primary design decision when migrating from App Mesh is how to replicate existing canary deployments (traffic weighting). ECS Service Connect does not directly support weighted routing between services, so use approaches such as Blue/Green deployments as an alternative. VPC Lattice supports weighted target groups for traffic splitting, providing control similar to App Mesh virtual routers. For mTLS, ECS Service Connect supports TLS encryption using AWS Private CA, but the AWS migration blog post from September 2024 describes mutual authentication (mTLS) as not yet available for Service Connect. VPC Lattice natively provides inter-service authorization through IAM auth policies, achieving zero-trust communication control through a different approach than mTLS. For migration to Service Connect, the AWS migration blog post describes a blue/green strategy that creates duplicate copies of each ECS service and gradually shifts traffic.
Summary
App Mesh was a service mesh that controlled and monitored microservice communication through Envoy proxies. It enabled canary deployments via traffic weighting, retry policies, and circuit breakers through declarative configuration, while encrypting communication with mTLS. However, since AWS ended support for App Mesh on September 30, 2026, the migration targets are ECS Service Connect (for intra-ECS communication) or Amazon VPC Lattice (for cross-VPC/cross-account communication).
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS App Mesh official page
- Amazon ECS official page
- Amazon EKS official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.