Building a Service Mesh with AWS App Mesh - Controlling and Observing Microservice Communication
Learn how to declaratively configure canary deployments, retry policies, and mTLS encryption using Envoy sidecars, and visualize service dependencies with X-Ray integration.
Overview of App Mesh
App Mesh is a service mesh that controls and monitors communication between microservices. It deploys an Envoy proxy as a sidecar alongside each service, routing inter-service traffic through the proxies. Without modifying application code, you can configure traffic weighting, retries, timeouts, and circuit breakers.
Traffic Control and Observability
Virtual routers let you configure traffic weighting for canary deployments, such as routing 10% of traffic to a new version. By gradually adjusting the weights (10% to 25% to 50% to 100%), you can safely migrate traffic. Retry policies allow you to declaratively define settings like retrying up to 3 times on HTTP 503 errors with exponential backoff. Circuit breakers use outlier detection to temporarily remove endpoints from the routing pool when their error rate exceeds a threshold. X-Ray integration enables Envoy proxies to automatically send trace data, visualizing call chains, latency, and error rates between services. CloudWatch metrics let you monitor request counts, latency, and error rates on a per-service basis. If cross-VPC or cross-account service communication is your primary requirement, VPC Lattice is also worth considering since it eliminates the need to operate Envoy.
mTLS and Access Control
App Mesh can encrypt communication between Envoy proxies using mTLS. When you configure certificates issued by ACM Private CA on virtual nodes, mutual authentication occurs during the proxy handshake, preventing impersonation. SDS (Secret Discovery Service) also automates certificate rotation. For access control, you explicitly define which services are allowed as backends for virtual nodes, blocking unintended inter-service communication. Envoy access logs can be sent to CloudWatch Logs to audit which services accessed which endpoints. To deepen your understanding of App Mesh network design, specialized books on Amazon can be helpful.
App Mesh Pricing and Optimization
App Mesh itself incurs no additional charges. Costs depend on the computing resources (CPU and memory) consumed by the Envoy proxies. Since they run as sidecars in ECS tasks or EKS Pods, it is important to properly size the resources allocated to the proxy in your task definition. A typical baseline is 256 MB of memory and 0.25 vCPU per proxy, though services with high traffic volumes may need more. When enabling X-Ray tracing, trace data storage costs apply, so adjust the sampling rate to balance cost and observability.
Summary
App Mesh is a service mesh that controls and monitors microservice communication through Envoy proxies. It enables canary deployments via traffic weighting, retry policies, and circuit breakers through declarative configuration, while encrypting communication with mTLS. X-Ray integration provides distributed tracing, visualizing service dependencies and latency.