Amazon VPC Lattice · Application networking

Connect and control traffic per service, across VPCs and accounts

Amazon VPC Lattice brings services and resources spread across multiple VPCs and accounts into a single service network. You define routing, authentication, and logging per service, without building network connectivity between VPCs yourself.

See setup steps View architecture
Service network · prodauth AWS_IAM
  • orders/api/* → tg-orders (IP · EKS Pods)HTTPS
  • inventoryweight 90 / 10 → tg-v1, tg-v2HTTP
  • paymentsTLS terminated at target → tg-pay (TCP)TLS
  • rds-primaryresource configuration → resource gatewayTCP

Services register with HTTP, HTTPS, or TLS listeners; TCP resources such as databases register as resource configurations.

3

Listener protocols (HTTP · HTTPS · TLS)

4

Target group types (Instance · IP · Lambda · ALB)

SigV4

Auth policies based on IAM-signed requests

RAM

Share services, service networks, and resources across accounts

Why VPC Lattice

Connect services, not VPCs

When you open service-to-service traffic with VPC peering or Transit Gateway, CIDR planning, route tables, and security group rules grow with every VPC. VPC Lattice makes the service the unit of communication, so network and application teams each manage only their own part.

Connect

Works with overlapping CIDRs

VPC Lattice supports overlapping CIDRs. Call services across VPCs and accounts without redesigning your address plan.

Secure

Per-request authentication

Use IAM auth policies alongside security groups to decide who can call which service. Authenticated requests are signed with SigV4.

Delegate

Separation of duties

Network administrators manage service networks and policies; service owners manage listeners and target groups. Share across accounts with AWS RAM.

Object model

Four levels under the service network

A request enters a service's listener through the service network, and listener rules select a target group. Containment flows from top to bottom.

containerService network

Logical boundary

The boundary that groups services and resource configurations. Client VPCs enter through a VPC association or a service network endpoint.

VPC associationSN endpointauth policyaccess logs
unitService

Independently deployable unit

An application that provides a single function. It gets a domain name generated by VPC Lattice, and can also use a custom domain.

generated FQDNcustom domainauth policy
entryListener · Rule

Protocol, port, and routing rules

A listener accepts requests on a port with one of HTTP, HTTPS, or TLS. Rules consist of a priority, conditions, and actions.

HTTPHTTPSTLSpath · header · methodfixed-response
backendTarget group

Targets that handle requests

Register EC2 instances, IPs, Lambda functions, or ALBs. Amazon ECS tasks and Kubernetes Pods can also be targets, and ECS performs blue/green, linear, and canary deployments with Lattice target groups.

INSTANCEIPLAMBDAALBHTTP/1.1 · HTTP/2 · gRPC

Features

Key features

Routing

Listener rules

Split requests by path, header, or HTTP method. Send traffic to multiple target groups with weights from 0–999 for canary deployments, or return 404 or 500 with a fixed-response action.

Authorization

Auth policy

Attach IAM policies to the service network and to each service. With the AWS_IAM auth type, both policies must explicitly allow a request for it to pass.

Multi-account

AWS RAM sharing

Share services, service networks, and resource configurations with specific accounts, OUs, or your entire organization. Shared services appear in the service directory.

TCP resources

Resource configuration

Expose Amazon RDS databases (ARN), domain names, private IPs, and CIDR ranges over TCP to other VPCs and accounts. A resource gateway is the entry point into the resource VPC. When you add a custom domain, a private hosted zone is created automatically in the consumer VPC, and with DNS resolution set to IN_VPC you can also use private domain names as targets.

Hybrid access

Service network endpoint

Create a VPC endpoint of type service network in a VPC, and on-premises networks connected through Direct Connect or VPN can reach services and resources. A single VPC can also connect to multiple service networks.

Observability

Access logs

Enable access logs per service network, service, or resource configuration, and deliver them to CloudWatch Logs, Amazon S3, or Amazon Data Firehose.

Services vs resources

Services and resource configurations

Register HTTP-family applications as services, and resources accessed over TCP, such as databases, as resource configurations.

Comparison of VPC Lattice services and resource configurations
TypeProtocolTargetsClient accessAuth policy
Service
VPC Lattice service		 HTTP · HTTPS · TLS listeners Instance · IP · Lambda · ALB target groups VPC association, service network endpoint Service network and service policies apply
Resource configuration
ARN · domain · IP		 TCP RDS databases, domain names, private IPs VPC association, service network endpoint, resource endpoint Service network policy does not apply
Resource configuration
CIDR		 TCP_UDP (UDP for DNS queries only) List of CIDRs to share (e.g. 10.0.0.0/24) Tunnel endpoint only; cannot be associated with a service network Service network policy does not apply

Auth policy

Define who can call what with IAM policies

With the AWS_IAM auth type, the default is deny all. Without a policy, every request receives access denied.

service auth policyJSON
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "vpc-lattice-svcs:Invoke",
    "Resource": "*",
    "Condition": {
      "StringNotEquals": {
        "aws:PrincipalType": "Anonymous"
      },
      "StringEquals": {
        "vpc-lattice-svcs:SourceVpc": "vpc-1a2b3c4d"
      }
    }
  }]
}
Example auth policy that allows only SigV4-signed requests from a specified VPC

  1. Check the service network policy

    If an auth policy is enabled and there is no explicit allow, the request is denied.

  2. Check the service policy

    If the service also has a policy, the request is evaluated again the same way. Put common rules on the service network and narrower rules on the service.

  3. Check the caller's IAM policies

    The calling role's identity-based policies must also allow the request. An explicit deny in any policy overrides an allow.

Reference architecture

Services and databases from multiple accounts in one network

Client VPCs associate with the service network, and on-premises networks come in through a service network endpoint. Services and databases stay in their owning accounts and are shared with AWS RAM.

VPC Lattice reference architecture Client VPCs enter the service network through a VPC association; on-premises networks enter through a service network endpoint in a VPC connected via Direct Connect or VPN. The service network contains the orders and inventory services and the rds-primary resource configuration. Services in account B send requests to EKS Pods in an IP target group and to a Lambda target group, and the resource gateway in account C forwards TCP connections to Amazon RDS. Services and resources are shared with AWS RAM. CLIENTS SERVICE NETWORK · AWS_IAM ACCOUNT B · SERVICE OWNER ACCOUNT C · DB VPC Client VPCEC2 · containers Connectivity VPCSN endpoint On-premisesData center DX · VPN association endpoint ordersHTTPS:443 · path rules inventoryHTTP:80 · weighted forward rds-primaryresource configuration · TCP auth policy: service network + service access logs: CloudWatch · S3 · Firehose Target group · IPEKS Pods · ECS tasks Target group · LambdaLambda function RAM RAM Resource GWSet of ENIs Amazon RDSTCP 5432 RAM
Client request entry (association · endpoint) Request forwarded from service network to targets Hybrid connectivity (DX · VPN)Responses return along the same path.

On narrow screens, scroll the diagram horizontally.

Getting started

Steps to connect your first service

  1. STEP 1

    Create a target group

    Choose the target type, protocol, and health checks, then register targets.

  2. STEP 2

    Service and listener

    Create a service and configure the listener protocol, port, and default rule.

  3. STEP 3

    Create a service network

    Choose the auth type (NONE or AWS_IAM) and the access log destination.

  4. STEP 4

    Associate services

    Associate the service with the service network. For services in other accounts, receive them through RAM sharing, then associate.

  5. STEP 5

    VPC association and policy

    Associate the client VPC with security groups, attach an auth policy, and verify calls.

Pricing

Pricing dimensions

Services are billed by running hours, data processed, and number of requests. Resource configurations are billed by hours associated with a service network and data processed.

Amazon VPC Lattice pricing dimensions
DimensionBilling basisNotes
Service hoursPer service per hour (partial hours billed as full hours)Rates vary by Region
Service data processingGB processed by the serviceRequests received and responses returned are combined. Cross-AZ transfer is included in this charge
Requests · connectionsRequests for HTTP · HTTPS listeners, TCP connections for TLS listeners (per million per hour)The first 300,000 per hour per service are not charged
Resource configuration hoursPer resource per hour associated with a service networkRates vary by Region
Resource data processingGB processed to resources, tiered by monthly cumulative usage per RegionTiers: first 1 PB, next 4 PB, over 5 PB
VPC association · service network endpointNo chargeResource endpoints and tunnel endpoints are billed at AWS PrivateLink rates
Related chargesBilled by other servicesNAT gateways needed for domain-name resources pointing to IPs outside the VPC (Amazon VPC pricing), and access log destinations (CloudWatch Logs · S3 · Firehose pricing)

Rates vary by Region and usage. For current rates, see the Amazon VPC Lattice pricing page.

Next step

Redraw your service-to-service communication with VPC Lattice

Bring your call relationships, account structure, and authentication requirements, and we will review the service network boundaries and policy design together.

Open service page Read the user guide