Choosing the Right Tool
AWS provides several mechanisms for cross-VPC service communication. Choosing the wrong one is a common architecture mistake. Here is a precise comparison:
| Mechanism | Overlapping CIDRs | Cross-Account | IAM Auth | Layer | Best For |
|---|---|---|---|---|---|
| VPC Peering | ❌ No | ✅ Yes | ❌ No | L3 | Simple, low-volume VPC-to-VPC connectivity |
| Transit Gateway | ❌ No | ✅ Yes | ❌ No | L3 | Hub-and-spoke network topology at scale |
| AWS PrivateLink | ✅ Yes | ✅ Yes | ❌ No (app-level only) | L4 | Exposing a single service to many consumers; SaaS patterns |
| VPC Lattice | ✅ Yes | ✅ Yes | ✅ Yes (native) | L7 | Service-to-service communication with identity-based auth |
| App Mesh / Istio | ✅ Yes | ✅ Yes | ✅ Yes (mTLS) | L7 | Full service mesh with advanced traffic management; non-AWS workloads |
Key decision rules:
- Use VPC Peering when you have two VPCs with non-overlapping CIDRs and simple, low-complexity connectivity needs. It is the lowest-cost option.
- Use Transit Gateway when you have many VPCs that all need to communicate and you want centralized routing control. TGW is the right answer for "hub and spoke" network architectures.
- Use PrivateLink when a service provider wants to expose a single endpoint to many consumer accounts without giving those consumers any broader network access. Classic SaaS pattern.
- Use VPC Lattice when you have multiple services across multiple VPCs/accounts that need to call each other, you want IAM-based authorization, and you want to avoid managing network plumbing. This is the default choice for modern microservice architectures on AWS.
- Use App Mesh or Istio when you need advanced traffic management (circuit breaking, retries, canary routing at the mesh level), have non-HTTP workloads, or are running multi-cloud/hybrid workloads where AWS-native IAM is not available.
Cost consideration: Lattice charges per service network association, per request processed, and per GB of data transferred. For very high-throughput, low-latency internal services (e.g., a caching layer called millions of times per second), the per-request cost may make PrivateLink or even direct VPC Peering more economical. Always model the cost before committing.