AWS App Mesh

AWS App Mesh is a managed service mesh for teams coordinating service-to-service traffic across AWS compute environments. Its Envoy-based controls, monitoring and mutual TLS suit deployments that need centralized traffic management, but the approaching end of support makes it hard to justify for a new long-term system.

Overview

App Mesh uses Envoy sidecar proxies to manage traffic into and out of service containers. Teams can adjust routes between services without changing application code, while AWS manages the highly available service instead of requiring teams to install and operate application-level communications infrastructure.

The main caveat is decisive: support ends on September 30, 2026. After that, the console and App Mesh resources will no longer be accessible. That short remaining runway makes App Mesh a poor foundation for a new service mesh expected to last; it is more plausible for an existing deployment with a migration plan.

Key features

• Routing and load balancing: Routing can change without application-code updates. Envoy proxies also balance client traffic and adjust endpoints based on health checks and service registration, which is useful when service membership changes.
• Monitoring: App Mesh provides metrics and logs for service hops and can collect traces to visualize service API calls. Integrations include Amazon CloudWatch and AWS X-Ray, plus tools such as Datadog, HashiCorp and Sysdig. Envoy-compatible monitoring examples include Splunk, Prometheus, Jaeger, Flagger, Grafana, Zipkin and LightStep.
• Service identity: Mutual TLS verifies identity between services. Certificates can come from AWS Certificate Manager Private Certificate Authority or a customer-managed certificate authority, giving teams options for certificate administration.
• AWS deployment coverage: Supported environments include AWS Fargate, Amazon ECS, Amazon EKS, Amazon EC2 and Kubernetes on EC2. This makes it relevant to teams operating across those environments, rather than a general-purpose mesh for arbitrary infrastructure.
• Security requirements: API clients must support TLS 1.2; AWS recommends TLS 1.3. Client compatibility should be considered when integrating App Mesh.

Pricing

AWS App Mesh: free. There is no additional charge for using App Mesh, but AWS resources consumed by the proxy are billed separately. The free service therefore does not mean cost-free operation: proxy resource usage remains part of the deployment's AWS bill.

Platforms

App Mesh is a managed service with a sidecar proxy architecture and supports mutual TLS and traffic policies. Its supported environments are Amazon ECS, Amazon EKS, Kubernetes on Amazon EC2 and Amazon EC2. The broader platform coverage includes API, Linux, macOS, web and Windows.

Who it's for

App Mesh best fits teams already running services in its supported AWS environments that need to control routing and observe service hops without operating their own application-level communications layer. Mutual TLS and integrations with AWS monitoring services can help those teams bring service identity and visibility into the same mesh.

It is not a sensible default for a fresh, long-lived deployment: the September 30, 2026 support end date means teams would need to account for migration soon after adopting it. Organizations without a migration path should look elsewhere.

Pros and cons

• Pro: Dynamic routing and proxy load balancing can respond to health checks and service registration without application-code changes.
• Pro: Metrics, logs and traces, alongside mutual TLS, combine operational visibility and service identity controls.
• Pro: There is no additional App Mesh charge, although proxy resources still incur AWS costs.
• Con: Support ends on September 30, 2026, sharply limiting its suitability for new deployments.
• Con: Proxy resource costs are separate, so the free service does not remove infrastructure expense.

Alternatives

For teams seeking another open-source mesh, Buoyant Enterprise for Linkerd has an always-free open-source option for production use at any scale for companies with fewer than 50 employees, as well as a free trial.

Flomesh Service Mesh is an open-source service mesh for Kubernetes. Istio offers open-source releases at no cost, while Kuma has an open-source control plane for Kubernetes, VMs and bare metal. Linkerd is another free, open-source option that requires Kubernetes.

Kong Gateway is an alternative for readers looking at an API gateway; its open-source edition is free. VMware Workstation Pro is also listed as a free option, for Windows or Linux hosts on 64-bit Intel or AMD PCs. Google Cloud Service Mesh is a paid alternative with managed control plane, telemetry dashboards and managed certificate authority.

Compare more options in Service Mesh Platforms.

Verdict

Choose AWS App Mesh if you already run supported AWS workloads and need managed Envoy routing, service visibility and mutual TLS, with a near-term migration plan. Its no-additional-charge service is useful, but proxy resources still cost money and the September 30, 2026 support end makes another platform the safer choice for a new deployment intended to endure.