Service Networking with Amazon VPC Lattice - Simplifying Communication Between Microservices
Simplifies cross-VPC / cross-account communication between microservices with L7 service networking that does not require Envoy proxies. Introduces IAM authentication and how to choose between VPC Lattice and App Mesh (AWS ended support for App Mesh on September 30, 2026).
How a Service Network Is Structured
VPC Lattice provides service networking at the application layer (L7) and simplifies communication between services that span multiple VPCs and accounts. A service network is a logical boundary that groups related services. When you associate a VPC with a service network, resources in that VPC can access all services in the service network. Each service is assigned an automatically generated DNS name, and cross-VPC communication is possible without configuring VPC peering or Transit Gateway. With RAM (Resource Access Manager), you can share service networks and services with other accounts.
Routing and Authentication
You configure listeners (HTTP or HTTPS) on a service and define routing based on the request path, headers, and method with listener rules. You can register EC2 instances, IP addresses, ECS tasks, Lambda functions, and ALBs in a target group, which lets you handle different compute types in a uniform way. Weighted routing splits traffic across multiple target groups and makes canary releases and Blue/Green deployments possible. You apply IAM auth policies to a service network or a service and control access based on the caller's IAM role. Requests are authenticated with SigV4 signatures, and only services allowed by the policy can communicate.
Choosing Between VPC Lattice and App Mesh
VPC Lattice and App Mesh are both services that manage communication between services, and they differed in the layer they covered and in their operating model. However, AWS ended support for App Mesh on September 30, 2026 (after that date, you cannot access the App Mesh console or resources). VPC Lattice provides L7 service networking as an AWS-managed service, and it does not require deploying or managing Envoy proxies. App Mesh was an Envoy-based service mesh that allowed fine-grained control of circuit breakers and retry policies, but it carried the operational burden of sidecar proxies. VPC Lattice has strengths in cross-VPC / cross-account communication between services and is suited to environments where microservices are distributed across multiple VPCs and accounts. App Mesh was suited to fine-grained traffic control within a single VPC (canary deployments, traffic shifting). It was also possible to use both together, with a configuration that managed communication between VPCs with Lattice and communication within a VPC with App Mesh.
VPC Lattice Pricing
VPC Lattice pricing consists of three elements: hourly charges for services, the number of requests, and the amount of data processed. Each service costs about $0.025 per hour, requests cost about $0.10 per 1 million requests, and data processing costs about $0.025 per 1 GB (as of August 2026). Compared with ALB, the per-request price is lower, but in environments with many services, the hourly charges for services add up. VPC associations with a service network are free, and no additional network charges are incurred even when services are accessed from multiple VPCs. You optimize costs by sending access logs to S3, analyzing traffic patterns, and considering consolidating services that are used infrequently.
Simplifying Connections Across VPCs and Accounts
When microservices are distributed across multiple VPCs and accounts, establishing communication paths between services becomes cumbersome. Traditionally, you had to connect networks with peering or Transit Gateway, watch out for overlapping IP addresses, and design the routing. VPC Lattice provides a mechanism that lets you connect at the service level in a logical way without having to think about these network details. Once you register a service in the network, services can call each other across boundaries. A major advantage is that application developers can achieve integration between services without going deep into low-layer network design.
Observability and Access Control
As communication between services increases, understanding which service calls which service and whether communication is healthy becomes important for operations. VPC Lattice provides means to record communication logs and visualize the interactions between services. This makes it easy to understand dependencies and to isolate problems during failures. For access control, you can use auth policies to restrict calls to a specific service to allowed services and principals only. In addition to network-level control, you can allow / deny communication in a fine-grained way per service, so you can achieve communication control close to zero trust.
Summary
VPC Lattice simplifies the network configuration for communication between microservices and achieves access control between services with IAM-based authentication. It provides cross-VPC / cross-account communication through service networks without Envoy proxies and significantly reduces the operational burden compared with App Mesh. It controls traffic based on paths and headers with L7 routing rules and analyzes traffic patterns with access logs.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- Amazon VPC official page
- Amazon ECS official page
- AWS Lambda official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.