Skip to content
SPECIFICTION
Get listed

AWS App Mesh

aws.amazon.com

Free plan WebWindowsmacOSLinuxAPI
Visit aws.amazon.com
Spec score 9.1 #1 of 22 in Service Mesh Platforms

What it is

AWS App Mesh is a managed service for visibility and traffic control between services. It uses the open source Envoy proxy to handle traffic into and out of service containers, and can change routes between services without application-code changes. Proxies balance client traffic and adjust endpoints using health checks and service registration. App Mesh provides metrics and logs for service hops, and can collect traces to help visualize service API calls. It works with AWS Fargate, Amazon ECS, Amazon EKS, Amazon EC2 and Kubernetes on EC2. Mutual TLS verifies service identities using certificates from AWS Certificate Manager Private Certificate Authority or a customer-managed certificate authority. Listed integrations include Amazon CloudWatch and AWS X-Ray, plus tools such as Datadog, HashiCorp and Sysdig. There is no additional charge for App Mesh itself, but proxy-consumed AWS resources are billed separately. AWS states support ends on September 30, 2026; after that, the console and App Mesh resources will no longer be accessible. API clients must support TLS 1.2; AWS recommends TLS 1.3.

Spec sheet

What it does
AWS App Mesh is a managed service mesh that standardizes microservice communication and provides visibility and traffic controls through lightweight proxies.Read 15 Oct 2026 · docs.aws.amazon.com
Purpose
AWS App Mesh provides visibility and network traffic controls for service-to-service communication.Read 4 Oct 2026 · aws.amazon.com
Integrations
The feature page lists Amazon CloudWatch and AWS X-Ray, along with partner and open source tools including Datadog, HashiCorp, and Sysdig.Read 4 Oct 2026 · aws.amazon.com
Security
AWS App Mesh API clients must support TLS 1.2, and AWS recommends TLS 1.3.Read 4 Oct 2026 · docs.aws.amazon.com
API and SDKs
AWS publishes an App Mesh API reference, CLI reference and SDKs that sign requests, retry calls and handle errors.Read 15 Oct 2026 · docs.aws.amazon.com
ARM64 limitation
AWS's example walkthroughs target amd64 Linux; ARM64 requires Envoy version 1.20.0.1 or later and App Mesh Controller version 1.4.2 or later.Read 15 Oct 2026 · github.com
Authentication
App Mesh supports mutual TLS for service-to-service identity verification and describes using certificates from AWS Certificate Manager Private Certificate Authority or a customer-managed certificate authority.Read 4 Oct 2026 · aws.amazon.com
Authentication certificates
TLS certificates can come from AWS Private Certificate Authority, a local file system or an Envoy Secret Discovery Service endpoint.Read 15 Oct 2026 · docs.aws.amazon.com
Client-side load balancing
Envoy proxies load balance requests and add or remove endpoints using health checks and service registration.Read 15 Oct 2026 · aws.amazon.com
Company founded
AWS's LinkedIn profile lists 2006 as its founding year.Read 15 Oct 2026 · linkedin.com
Company headquarters
AWS's LinkedIn profile lists Seattle, Washington as headquarters.Read 15 Oct 2026 · linkedin.com
Company legal name
LinkedIn identifies the maker as Amazon Web Services (AWS), a public IT services and consulting company.Read 15 Oct 2026 · linkedin.com
Company size
AWS's LinkedIn profile lists more than 10,001 employees.Read 15 Oct 2026 · linkedin.com
Documentation depth
AWS provides a user guide, API reference, CLI reference, interactive workshop, examples and a public roadmap.Read 15 Oct 2026 · docs.aws.amazon.com
End of support
AWS states that App Mesh support ends on September 30, 2026, after which the console and App Mesh resources will be inaccessible.Read 15 Oct 2026 · docs.aws.amazon.com
Kubernetes controller
The App Mesh Controller for Kubernetes watches custom resources and maps meshes, nodes, routers, services, gateways and routes to App Mesh API objects while injecting sidecars.Read 15 Oct 2026 · aws.github.io
Launch news
AWS announced App Mesh in an AWS News Blog post dated March 27, 2019.Read 15 Oct 2026 · aws.amazon.com
Limit: external services
G2 reviewers report that App Mesh works poorly with services outside the AWS environment and lacks a built-in dashboard.Read 15 Oct 2026 · g2.com
Limit: missing controls
TrustRadius reviewers report no RBAC-style policies, native rate limiting or circuit breaking.Read 15 Oct 2026 · trustradius.com
Limit: pricing
G2 reviewers complain that total pricing can be too high for small companies even though App Mesh has no separate service fee.Read 15 Oct 2026 · g2.com
Limit: setup complexity
TrustRadius reviewers describe setup and configuration as complex and request simpler onboarding.Read 15 Oct 2026 · trustradius.com
Load balancing
Its proxies load balance client traffic and adjust endpoints based on health checks and service registration.Read 4 Oct 2026 · aws.amazon.com
Managed service
AWS describes App Mesh as a managed, highly available service that avoids the need to install or manage application-level communications infrastructure.Read 4 Oct 2026 · aws.amazon.com
Management interfaces
Users can manage App Mesh through the AWS Management Console, AWS CLI, AWS Tools for PowerShell and CloudFormation.Read 15 Oct 2026 · docs.aws.amazon.com
Monitoring
App Mesh provides metrics and logs for service hops and can collect traces to help visualize service API calls.Read 4 Oct 2026 · aws.amazon.com
Mutual TLS
Mutual TLS supports TCP, HTTP/1.1, HTTP/2 and gRPC, but traffic between applications and their Envoy proxies remains unencrypted.Read 15 Oct 2026 · docs.aws.amazon.com
Observability
App Mesh collects service metrics, logs and traces and integrates with Amazon CloudWatch and AWS X-Ray.Read 15 Oct 2026 · aws.amazon.com
Onboarding cutoff
The AWS examples repository says new customers have been unable to onboard since September 24, 2024, while existing customers could continue using the service until September 30, 2026.Read 15 Oct 2026 · github.com
Partner integrations
AWS lists Datadog, Alcide, HashiCorp, Sysdig, SignalFx, Spotinst, Tetrate, NeuVector, Weaveworks, Twistlock, Wavefront and Aqua as compatible partner or open-source tools.Read 15 Oct 2026 · aws.amazon.com
Praise: AWS integration
G2 reviewers praise compatibility with ECS, EKS, EC2 and Fargate and the convenience of AWS integrations.Read 15 Oct 2026 · g2.com
Praise: observability and security
G2 reviewers repeatedly praise end-to-end visibility, monitoring, security and traffic control.Read 15 Oct 2026 · g2.com
Praise: service control
TrustRadius reviewers praise service-level traffic control, dynamic service discovery and deep visibility into service-to-service communication.Read 15 Oct 2026 · trustradius.com
Proxy
App Mesh uses the open source Envoy proxy to manage traffic into and out of service containers.Read 4 Oct 2026 · aws.amazon.com
Proxy technology
The data plane uses the open-source Envoy proxy and its ecosystem of monitoring integrations.Read 15 Oct 2026 · aws.amazon.com
Rating on G2
4.3 out of 5 from 14 reviewsRead 15 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.7 out of 5 from 6 ratingsRead 15 Oct 2026 · gartner.com
Rating on TrustRadius
6.4 out of 10 from 39 reviewsRead 15 Oct 2026 · trustradius.com
Retries
Virtual-node routes support retry policies for connection errors and protocol-specific failures.Read 15 Oct 2026 · docs.aws.amazon.com
Security encryption
TLS encrypts communication between Envoy proxies representing mesh endpoints such as virtual nodes and gateways.Read 15 Oct 2026 · docs.aws.amazon.com
Security model
AWS documents App Mesh under a shared-responsibility model covering IAM, CloudTrail, data protection, infrastructure security, resilience and compliance validation.Read 15 Oct 2026 · docs.aws.amazon.com
Self-hosting model
App Mesh itself is an AWS-managed control plane; customers deploy the Envoy proxy alongside each service rather than self-hosting the control plane.Read 15 Oct 2026 · aws.amazon.com
Supported compute
Supported workloads include AWS Fargate, Amazon ECS, Amazon EKS, Amazon EC2 and Kubernetes on EC2.Read 15 Oct 2026 · aws.amazon.com
Supported environments
The feature page says App Mesh works with AWS Fargate, Amazon ECS, Amazon EKS, Amazon EC2, and Kubernetes on EC2.Read 4 Oct 2026 · aws.amazon.com
System requirement
An existing service must run on Fargate, ECS, EKS, Kubernetes on EC2 or EC2 with Docker before App Mesh can be used.Read 15 Oct 2026 · docs.aws.amazon.com
Third-party monitoring
The FAQs list Splunk, Prometheus, Jaeger, Flagger, Grafana, Zipkin, and LightStep as examples of Envoy-compatible monitoring tools.Read 4 Oct 2026 · aws.amazon.com
Traffic routing
Traffic routes can be changed dynamically between services without modifying application code.Read 15 Oct 2026 · aws.amazon.com

Plans and prices

AWS App Mesh Free There is no additional charge for using AWS App Mesh; you pay for the AWS resources consumed by the proxy. Proxy resource costs billed separately Read 4 Oct 2026 · aws.amazon.com
AWS App Mesh usage Free No additional App Mesh charge; AWS bills the EC2 instances or requested Fargate CPU and memory consumed by the proxy Proxy resource costs · Related ECS/Fargate/EC2/EKS charges Read 15 Oct 2026 · aws.amazon.com

Every AWS App Mesh plan and price →

Strong points and limits

Strong points

  • Routes can change without application-code changes.
  • Proxies balance traffic using health checks and service registration.
  • Provides service-hop metrics and logs, and can collect traces.
  • Supports mutual TLS for service identity verification.
  • No additional charge for App Mesh itself.

Limits

  • Proxy-consumed AWS resources are billed separately.
  • Support ends on September 30, 2026.
  • Console and resources become inaccessible after support ends.
  • API clients must support TLS 1.2.

Who it suits

It suits teams running services in the supported AWS environments that need traffic controls, metrics, logs, traces or mutual TLS. The stated end of support is an important constraint for anyone considering it.

AWS App Mesh in depth

Read the full write-up

Overview

AWS App Mesh is a managed service mesh that controls and observes traffic between services. It best suits teams running services across AWS compute environments that need traffic management, visibility, and mutual TLS; its Envoy sidecars and managed control plane are useful, but its support end date makes it a poor foundation for a long-lived new deployment.

App Mesh places Envoy proxies alongside service containers to manage traffic into and out of them. Routing can be changed without application-code updates, while AWS manages the service rather than requiring teams to install or operate application-level communications infrastructure. That operational benefit is sharply time-limited: support ends September 30, 2026, after which the console and App Mesh resources will no longer be accessible. Existing users planning a near-term migration may still find it useful; new adopters should weigh that deadline carefully.

Key features

Traffic control: Teams can change service-to-service routing without changing application code. Envoy proxies also load-balance client traffic and adjust endpoints based on health checks and service registration, a practical fit for services whose endpoints change.

Visibility: App Mesh provides metrics and logs for service hops and can collect traces to visualize service API calls. CloudWatch and X-Ray are named integrations; Envoy-compatible monitoring examples include Datadog, HashiCorp, Sysdig, Splunk, Prometheus, Jaeger, Flagger, Grafana, Zipkin, and LightStep.

Identity and security: Mutual TLS verifies service-to-service identity, using certificates from AWS Certificate Manager Private Certificate Authority or a customer-managed certificate authority. API clients must support TLS 1.2; AWS recommends TLS 1.3.

Managed, sidecar deployment: The managed service is described as highly available, and the sidecar proxy architecture keeps traffic handling alongside service containers. This avoids managing communications infrastructure, but does not remove the separate cost of proxy resources.

Pricing

AWS App Mesh

The free plan costs nothing. There is no additional charge for using App Mesh, so it suits teams that want the managed control plane without a separate App Mesh fee. Proxy resource costs are billed separately, however, and the free service does not make the full deployment cost-free.

The support deadline is a more consequential term than the service price: after September 30, 2026, the console and App Mesh resources will no longer be accessible.

Platforms

App Mesh runs with AWS Fargate, Amazon ECS, Amazon EKS, Amazon EC2, and Kubernetes on Amazon EC2. The platform entry also identifies API, Linux, macOS, web, and Windows. Its deployment model is managed, with a sidecar proxy architecture.

Who it's for

App Mesh is most appropriate for teams already operating services in its supported AWS environments that need code-independent traffic routing, service-hop monitoring, or mutual TLS. The managed service can reduce the operational work of running application-level communications infrastructure. It is a poor fit for a new deployment expected to remain in place beyond the support end date, or for teams that need to avoid separate proxy resource costs.

Pros and cons

Pro: Dynamic routing and endpoint adjustment let teams respond to service changes without application-code edits.

Pro: Metrics, logs, traces, and integrations with AWS and Envoy-compatible tools give teams several ways to observe service communication.

Pro: Mutual TLS supports service identity verification with AWS PCA or a customer-managed certificate authority.

Con: Proxy resources cost extra, despite there being no additional charge for App Mesh itself.

Con: Support ends September 30, 2026, after which the console and resources will no longer be accessible. That limits its suitability for long-term adoption.

Alternatives

Service Mesh Platforms is a useful starting point for comparing the category.

Buoyant Enterprise for Linkerd is worth considering for teams seeking a freemium option with an always-free open-source plan, production use at any scale for companies with fewer than 50 employees, and a free trial.

Kong Gateway may suit readers who want a 30-day free trial with no Gateway limits and 30 days of analytics retention; its Plus plan has a price not listed.

Kuma offers an open-source control plane supporting Kubernetes, VMs, and bare metal, making it a candidate for teams using those environments.

Traefik Mesh is an open-source option for teams meeting its Kubernetes 1.11+, CoreDNS or KubeDNS, and Helm v3 requirements.

Flomesh Service Mesh is another open-source service mesh for Kubernetes.

HashiCorp Nomad offers a freemium model with self-managed enterprise plans.

Istio is an open-source service mesh with releases accessible at no cost.

VMware Workstation Pro is another free option.

Verdict

Choose AWS App Mesh if you already run services in its supported AWS environments and value managed Envoy-based routing, observability, and mutual TLS. Its operational advantages are clear, but separate proxy costs and the September 30, 2026 support end date make it hard to recommend for a new service mesh intended to last.

Verdict

App Mesh provides managed service-to-service traffic controls and observability across the listed AWS environments. Its September 30, 2026 support end date, and separate proxy resource costs, should factor into adoption decisions.

Where Specifiction places it

Alternatives to AWS App MeshAll alternatives →