AWS App Mesh

AWS App Mesh is a managed service mesh for controlling communication between services. It is best suited to teams running workloads on supported AWS compute platforms that need traffic controls, service visibility, and mutual TLS. Its operational convenience is undercut by a firm end-of-support date, making it a poor foundation for a new long-lived deployment.

Overview

App Mesh uses Envoy sidecar proxies to manage traffic into and out of service containers. Teams can update routes between services without changing application code, while AWS manages the highly available service instead of requiring teams to install and operate application-level communications infrastructure.

The central drawback is the short support horizon: AWS ends support on September 30, 2026. After that, the console and App Mesh resources will no longer be accessible. That makes App Mesh most defensible for an existing installation with a near-term migration plan, rather than a new deployment expected to last.

Key features

• Routing and load balancing: Envoy proxies can dynamically route traffic without application-code changes, balance client requests, and adjust endpoints based on health checks and service registration. This is useful when service endpoints change, though it does not offset the product’s approaching end of support.
• Service visibility: Metrics and logs cover service hops, and traces can help visualize service API calls. Integrations include Amazon CloudWatch and AWS X-Ray, plus partner and open-source tools such as Datadog, HashiCorp, and Sysdig. Envoy-compatible monitoring examples include Splunk, Prometheus, Jaeger, Flagger, Grafana, Zipkin, and LightStep.
• Service identity: Mutual TLS verifies identities between services. Certificates can come from AWS Certificate Manager Private Certificate Authority or a customer-managed certificate authority, giving teams a way to apply authenticated service-to-service communication.
• AWS workload support: App Mesh works with AWS Fargate, Amazon ECS, Amazon EKS, Amazon EC2, and Kubernetes on EC2. The supported-environment focus makes it a fit for those deployments, not a general-purpose option for workloads outside them.
• Transport security: API clients must support TLS 1.2; AWS recommends TLS 1.3.

Pricing

App Mesh has no additional service charge. The AWS App Mesh plan is free, but proxy resource costs are billed separately, along with the AWS resources those proxies consume. The free service charge therefore does not mean a deployment has no operating cost; teams should account for the underlying proxy resources.

Platforms

App Mesh is a managed service with a sidecar proxy architecture. Its supported platforms are Amazon ECS, Amazon EKS, Kubernetes on Amazon EC2, and Amazon EC2; the feature page also identifies AWS Fargate. It is aimed at AWS-based service deployments rather than teams seeking a mesh across a broader range of environments.

Who it's for

App Mesh suits teams already running services on its supported AWS platforms that need programmable traffic routing, load balancing, service-hop metrics and logs, traces, or mutual TLS. Its managed operation can spare teams from managing application-level communications infrastructure. New adopters should weigh that benefit against the September 30, 2026 end of support and loss of console and resource access afterward; without a migration plan, it is not a sound choice for a new long-term deployment.

Pros and cons

Pros

• Routing changes do not require application-code updates, which helps teams adapt service traffic as endpoints change.
• Visibility and security are built into the service mesh, with hop-level metrics and logs, traces, and mutual TLS support.
• No additional App Mesh charge, though proxy and other AWS resource costs still apply.

Cons

• Support ends September 30, 2026, and console and resource access ends with it, limiting its appeal for new or long-lived deployments.
• Proxy resources are billed separately, so the free service charge does not cover the full cost of running the mesh.
• Its supported environments are AWS-focused, which makes it a narrower fit for teams operating elsewhere.

Alternatives

For a broader comparison, see Service Mesh Platforms.

• Buoyant Enterprise for Linkerd is worth considering for teams seeking a freemium option with a free plan and trial; its open-source plan costs nothing, with production use available at any scale for companies with fewer than 50 employees.
• Kong Gateway offers a 30-day free trial with no credit card required, no Gateway limits, and 30 days of analytics retention; consider it if those trial terms suit your evaluation.
• Kuma is an open-source control plane supporting Kubernetes, VMs, and bare metal, making it an option for teams that need those environments.
• VMware Workstation Pro is another free software option.
• Flomesh Service Mesh is an open-source service mesh for Kubernetes.
• Istio is an open-source service mesh with releases accessible at no cost.
• Linkerd is an Apache 2.0-licensed open-source option that requires Kubernetes.
• HashiCorp Nomad offers customizable self-managed plans and premium support, with custom pricing.

Verdict

Choose AWS App Mesh if you already run services on its supported AWS platforms and need managed Envoy routing, visibility, and mutual TLS without an added App Mesh service charge. The approaching end of support—and loss of console and resource access afterward—is the main reason to look elsewhere, especially for a new deployment without a clear migration path.