Service Network Components
VPC Lattice introduces a three-level hierarchy that replaces the traditional subnet/route/security-group mental model. Understanding this hierarchy is the foundation for everything else.
Level 1 — Service Network: Think of this as a shared application bus or a private service registry. It is the top-level logical grouping. You associate VPCs with a Service Network, and once associated, resources in those VPCs gain the ability to discover and call services registered on the network. A Service Network spans accounts and VPCs — you can associate VPCs from entirely different AWS accounts into the same Service Network using AWS Resource Access Manager (RAM).
Level 2 — Service: A Service is a logical unit representing one application or microservice (e.g., "Payment-Service" or "Inventory-API"). Each Service has:
- One or more Listeners (e.g., HTTP on port 80, HTTPS on port 443).
- Routing Rules on each listener that match on path prefix, HTTP headers, or HTTP method and forward to a target group. This is identical in concept to ALB listener rules.
- A DNS name automatically generated by Lattice (e.g., payment-svc.abc123.vpc-lattice-svcs.us-east-1.on.aws).
Level 3 — Target Group: The actual compute that handles requests. Lattice supports four target types:
- EC2 instances (by instance ID or IP)
- Lambda functions
- Kubernetes pods (via EKS integration with the AWS Gateway API Controller)
- IP addresses (for any workload reachable by IP, including on-premises via Direct Connect)
The Magic Flow: A developer in VPC-A wants to call the Payment Service running in VPC-B. They simply call https://payment-svc.abc123.vpc-lattice-svcs.us-east-1.on.aws. Their VPC is associated with the Service Network. Lattice resolves the DNS, applies routing rules, checks IAM auth policies, and forwards the request to the correct target group — all transparently. No peering, no route tables, no security group IP rules.
Interviewers often ask: "How is VPC Lattice different from an Application Load Balancer?" The key distinction is scope. An ALB is a single-VPC construct — it load-balances traffic within or into one VPC. VPC Lattice is a multi-VPC, multi-account service mesh overlay. It provides service discovery, cross-account routing, IAM-based authorization, and overlapping CIDR support — none of which an ALB alone can provide. A Lattice Service uses target groups similar to an ALB, but the networking fabric underneath is fundamentally different.