Amazon VPC Lattice New2023年〜
An application networking service that simplifies service-to-service connectivity, security, and monitoring
What It Does
Amazon VPC Lattice is an application networking service that simplifies service-to-service communication across multiple VPCs and accounts. It provides unified management of service registration, traffic routing, authentication/authorization, and monitoring. It can connect services running on EC2, ECS, EKS, and Lambda.
Use Cases
Used for managing communication between microservices, connecting services across multi-account environments, traffic control for canary and blue-green deployments, and simplifying service meshes.
Everyday Analogy
Think of it like an internal phone system in a company. Each department (service) is assigned an extension number (endpoint), and the switchboard (Lattice) routes calls (requests) to the appropriate department. Call authentication and logging are handled automatically.
What Is VPC Lattice?
Amazon VPC Lattice is an application-layer networking service for service-to-service communication. Previously, connecting services across VPCs required combinations of VPC Peering, PrivateLink, and load balancers, but Lattice provides a unified abstraction layer to manage all of these.
Service Networks and Target Groups
In Lattice, you register services to a service network and associate VPCs. For each service, you define listeners and rules to route requests to target groups (EC2, ECS, Lambda, etc.). Weighted routing enables canary deployments, and IAM authentication controls service-to-service access. To deepen your understanding of service networks and target groups, related books on Amazon are also helpful.
Getting Started
Create a service network in the VPC Lattice console and associate VPCs. Create a service and configure listeners and target groups. On the client side, access the service using the DNS name generated by Lattice.
Things to Watch Out For
- VPC Lattice is an L7 (application layer) service. For L4 (transport layer) connectivity, use PrivateLink
- Only accessible from resources within VPCs associated with the service network. Direct internet access is not possible
