Simplify Service-to-Service Connectivity, Security, and Monitoring with Amazon VPC Lattice – Now Generally Available

At AWS re:Invent 2022, we introduced in preview Amazon VPC Lattice, a brand new functionality of Amazon Virtual Private Cloud (Amazon VPC) that provides you a constant option to join, safe, and monitor communication between your companies. With VPC Lattice, you’ll be able to outline insurance policies for community entry, site visitors administration, and monitoring to attach compute companies throughout cases, containers, and serverless functions.

Today, I’m joyful to share that VPC Lattice is now usually obtainable. Compared to the preview, you’ve entry to new capabilities:

• Services can use a customized area identify along with the area identify routinely generated by VPC Lattice. When utilizing HTTPS, you’ll be able to configure an SSL/TLS certificates that matches the customized area identify.
• You can deploy the open-source AWS Gateway API Controller to make use of VPC Lattice with a Kubernetes-native expertise. It makes use of the Kubernetes Gateway API to allow you to join companies throughout a number of Kubernetes clusters and companies working on EC2 cases, containers, and serverless capabilities.
• You can use an Application Load Balancer (ALB) or a Network Load Balancer (NLB) as a goal for a service.
• The IP handle goal kind now helps IPv6 connectivity.

Let’s see a few of these new options in follow.

Using Amazon VPC Lattice for Service-to-Service Connectivity
In my earlier put up introducing VPC Lattice, I present create a service community, affiliate a number of VPCs and companies, and configure goal teams for EC2 cases and Lambda capabilities. There, I additionally present route site visitors primarily based on request traits and use weighted routing. Weighted routing is admittedly useful for blue/inexperienced and canary-style deployments or for migrating from one compute platform to a different.

Now, let’s see use VPC Lattice to permit the companies of an e-commerce software to speak with one another. For simplicity, I solely take into account 4 companies:

• The Order service, working as a Lambda operate.
• The Inventory service, deployed as an Amazon Elastic Container Service (Amazon ECS) service in a dual-stack VPC supporting IPv6.
• The Delivery service, deployed as an ECS service utilizing an ALB to distribute site visitors to the service duties.
• The Payment service, working on an EC2 occasion.

First, I create a service community. The Order service must name the Inventory service (to verify if an merchandise is offered for buy), the Delivery service (to prepare the supply of the merchandise), and the Payment service (to switch the funds). The following diagram exhibits the service-to-service communication from the attitude of the service community.

These companies run in numerous AWS accounts and a number of VPCs. VPC Lattice handles the complexity of organising connectivity throughout VPC boundaries and permission throughout accounts in order that service-to-service communication is so simple as an HTTP/HTTPS name.

The following diagram exhibits how the communication flows from an implementation viewpoint.

The Order service runs in a Lambda operate related to a VPC. Because all of the VPCs within the diagram are related to the service community, the Order service is ready to name the opposite companies (Inventory, Delivery, and Payment) even when they’re deployed in numerous AWS accounts and in VPCs with overlapping IP addresses.

Using a Network Load Balancer (NLB) as Target
The Inventory service runs in a dual-stack VPC. It’s deployed as an ECS service with an NLB to distribute site visitors to the duties within the service. To get the IPv6 addresses of the NLB, I search for the community interfaces utilized by the NLB within the EC2 console.

When creating the goal group for the Inventory service, below Basic configuration, I select IP addresses because the goal kind. Then, I choose IPv6 for the IP Address kind.

In the subsequent step, I enter the IPv6 addresses of the NLB as targets. After the goal group is created, the well being checks take a look at the targets to see if they’re responding as anticipated.

Using an Application Load Balancer (ALB) as Target
Using an ALB as a goal is even simpler. When making a goal group for the Delivery service, below Basic configuration, I select the brand new Application Load Balancer goal kind.

I choose the VPC wherein to search for the ALB and select the Protocol model.

In the subsequent step, I select Register now and choose the ALB from the dropdown. I take advantage of the default port utilized by the goal group. VPC Lattice doesn’t present further well being checks for ALBs. However, load balancers have already got their very own well being checks configured.

Using Custom Domain Names for Services
To name these companies, I take advantage of customized domains. For instance, once I create the Payment service within the VPC console, I select to Specify a customized area configuration, enter a Custom area identify, and choose an SSL/TLS certificates for the HTTPS listener. The Custom SSL/TLS certificates dropdown exhibits obtainable certificates from AWS Certificate Manager (ACM).

Securing Service-to-Service Communications
Now that the goal teams have been created, let’s see how I can safe the best way companies talk with one another. To implement zero-trust authentication and authorization, I take advantage of AWS Identity and Access Management (IAM). When making a service, I choose the AWS IAM as Auth kind.

I choose the Allow solely authenticated entry coverage template in order that requests to companies should be signed utilizing Signature Version 4, the identical signing protocol utilized by AWS APIs. In this manner, requests between companies are authenticated by their IAM credentials, and I don’t should handle secrets and techniques to safe their communications.

Optionally, I might be extra exact and use an auth coverage that solely offers entry to some companies or particular URL paths of a service. For instance, I can apply the next auth coverage to the Order service to provide to the Lambda operate these permissions:

• Read-only entry (GET methodology) to the Inventory service /inventory URL path.
• Full entry (any HTTP methodology) to the Delivery service /supply URL path.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "<Order Service Lambda Function IAM Role ARN>"
            },
            "Action": "vpc-lattice-svcs:Invoke",
            "Resource": "<Inventory Service ARN>/stock",
            "Condition": {
                "StringEquals": {
                    "vpc-lattice-svcs:RequestMethod": "GET"
                }
            }
        },
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "<Order Service Lambda Function IAM Role ARN>"
            },
            "Action": "vpc-lattice-svcs:Invoke",
            "Resource": "<Delivery Service ARN>/delivery"
        }
    ]
}

Using VPC Lattice, I rapidly configured the communication between the companies of my e-commerce software, together with safety and monitoring. Now, I can concentrate on the enterprise logic as an alternative of managing how companies talk with one another.

Availability and Pricing
Amazon VPC Lattice is offered immediately within the following AWS Regions: US East (Ohio), US East (N. Virginia), US West (Oregon), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), and Europe (Ireland).

With VPC Lattice, you pay for the time a service is provisioned, the quantity of information transferred via every service, and the variety of requests. There is not any cost for the primary 300,000 requests each hour, and also you solely pay for requests above this threshold. For extra data, see VPC Lattice pricing.

We designed VPC Lattice to permit incremental opt-in over time. Each group in your group can select if and when to make use of VPC Lattice. Other functions can hook up with VPC Lattice companies utilizing commonplace protocols resembling HTTP and HTTPS. By utilizing VPC Lattice, you’ll be able to focus in your software logic and enhance productiveness and deployment flexibility with constant help for cases, containers, and serverless computing.

Simplify the best way you join, safe, and monitor your companies with VPC Lattice.

— Danilo