--- title: Hybrid & Edge on AWS (2026): Outposts vs Local Zones vs Wavelength — Placement, Connectivity, and the Latency Bill description: A composite fintech API (~8ms p99 to metro users) spent ~$22k/mo on hybrid infrastructure around an Outposts rack before moving read-heavy paths to a Chicago Local Zone and keeping Outposts only for card-PIN HSM proximity. p99 held at 9ms and hybrid infra dropped ~38%. This post covers placement and connectivity, not EC2-vs-Lambda unit economics. url: https://www.joinhorizon.co/blog/aws-hybrid-edge-integration-outposts-local-zones-wavelength-2026/ datePublished: 2026-06-25T00:00:00.000Z dateModified: 2026-10-28T00:00:00.000Z author: palaniappan-p category: Cloud Architecture tags: aws, aws-outposts, aws-local-zones, aws-wavelength, hybrid-cloud, direct-connect, latency --- # Hybrid & Edge on AWS (2026): Outposts vs Local Zones vs Wavelength — Placement, Connectivity, and the Latency Bill > A composite fintech API (~8ms p99 to metro users) spent ~$22k/mo on hybrid infrastructure around an Outposts rack before moving read-heavy paths to a Chicago Local Zone and keeping Outposts only for card-PIN HSM proximity. p99 held at 9ms and hybrid infra dropped ~38%. This post covers placement and connectivity, not EC2-vs-Lambda unit economics. **As of June 2026, AWS offers four distinct placement layers** (Regions, **Local Zones**, **Outposts**, and **Wavelength**) plus CloudFront for cacheable edge delivery. The expensive mistake is treating them as interchangeable “edge” checkboxes. **Local Zones** put AWS-operated compute in metros; **Outposts** put AWS-managed hardware on **your** floor; **Wavelength** puts compute in **carrier** 5G facilities. Pick wrong and you buy a rack when a subnet would do. This post covers **where workloads run and how packets move**, not [EC2 vs Lambda economics](https://www.joinhorizon.co/blog/hybrid-compute-ec2-serverless-cost-efficiency/). That hybrid-compute guide covers invocation patterns and SQS buffering; this one covers **metro latency, residency, Direct Connect, and the service link**. We ship a [placement decision matrix](https://www.joinhorizon.co/examples/architecture-blog-2026/hybrid-edge/placement-decision-matrix.md), [hybrid connectivity checklist](https://www.joinhorizon.co/examples/architecture-blog-2026/hybrid-edge/hybrid-connectivity-checklist.md), [latency vs cost worksheet](https://www.joinhorizon.co/examples/architecture-blog-2026/hybrid-edge/latency-cost-worksheet.csv), and [placement topology draw.io](https://www.joinhorizon.co/examples/architecture-blog-2026/hybrid-edge/hybrid-edge-placement-topology.drawio). > **Benchmark pattern (not a cited client):** Composite regulated **fintech API**, **~12k RPS** peak on payment authorization paths, users concentrated in **Chicago metro**, prior deployment **full Outposts rack** in customer colo for “low latency.” Measured **p99 ~8ms** app RTT. Migration: moved **read-heavy** account and catalog APIs to **Chicago Local Zone**; kept **Outposts** only for **PIN HSM** and card-present bridge. Result: **p99 ~9ms** (within SLO), hybrid infra **~$22k/mo to ~$13.6k/mo** (~**38%** reduction). Rack amortization and power dominate Outposts TCO when a Local Zone satisfies most paths. ## Placement matrix (summary) | Constraint | First choice | Avoid | | -------------------------- | ----------------------- | ---------------------------------------- | | Metro **<15 ms** RTT | **Local Zone** | Parent Region alone | | Must run on **your floor** | **Outposts** | Local Zone if law requires customer cage | | **5G handset** MEC | **Wavelength** | Outposts without mobility path | | Global **50–200 ms** OK | **Region** + CloudFront | Any edge hardware | Download the full [placement matrix](https://www.joinhorizon.co/examples/architecture-blog-2026/hybrid-edge/placement-decision-matrix.md) for service availability rows. **Opinionated take:** **Local Zones before Outposts** when compliance allows AWS-operated metro sites. **Wavelength only with a carrier contract**, otherwise you are paying for unused telco metal. ## Connectivity layer Edge placement fails without **hybrid networking**: 1. **Direct Connect** (primary) into a networking-account **Transit Gateway** 2. **Site-to-Site VPN** backup on a separate path 3. **Route 53 Resolver** split-horizon for internal API names 4. Non-overlapping **CIDR** across on-prem, Outposts, and Regional VPCs Outposts requires a **service link** to the parent Region. AWS documentation recommends **≥500 Mbps to 1 Gbps redundant** bandwidth. Undersize it and instability shows up as “mystery” API timeouts before user load spikes. For VPC design depth, see [VPC networking best practices](https://www.joinhorizon.co/blog/aws-vpc-networking-best-practices-for-production/). This post does not re-teach subnet sizing. Context (AWS CLI 2.x, networking account): ```bash aws directconnect describe-virtual-interfaces --query 'virtualInterfaces[*].[virtualInterfaceState,bgpStatus]' aws ec2 describe-transit-gateway-attachments --filters Name=state,Values=available ``` Full steps: [connectivity checklist](https://www.joinhorizon.co/examples/architecture-blog-2026/hybrid-edge/hybrid-connectivity-checklist.md). ## Local Zone vs Outposts in practice **Local Zones** extend a parent Region VPC. You create subnets mapped to the Local Zone; EC2 and EBS run locally while control-plane calls may still hit the Region. Service availability is a **subset**, so verify [Local Zone features](https://aws.amazon.com/about-aws/global-infrastructure/localzones/features/) before promising Aurora shapes. **Outposts** export instances that look like Regional EC2 but physically sit in your cage. Use when **data residency** demands customer-controlled facilities or when hardware (HSM, legacy appliance) cannot move. Capex and colo power are real, so model the [latency-cost worksheet](https://www.joinhorizon.co/examples/architecture-blog-2026/hybrid-edge/latency-cost-worksheet.csv) before signing a three-year rack order. > **What broke:** Platform team procured a **full Outposts rack** for “single-digit latency” to Chicago traders. Post-deploy measurement showed **read APIs** were cacheable and **p99 from us-east-1 was 42ms**, acceptable for half the portfolio. **Local Zone** pilots hit **9ms** for those paths at **~$1.2k/mo** incremental vs **~$22k/mo** rack TCO. Rack stayed for **HSM** only; everything else moved to Local Zone + Regional analytics. Measure the Region baseline before capex. ## Wavelength and 5G **AWS Wavelength** zones run in telco data centers at the edge of 5G networks, suited to video distribution, game streaming, and industrial AR with mobility. Prerequisites: **carrier partnership**, handset routing validated with telco NOC, and acceptance that service catalog is a **subset** of the parent Region. Wavelength without 5G integration is the most common “edge for edge’s sake” failure we see in architecture reviews. ## Residency cross-link When placement is driven by **sovereignty** rather than milliseconds, pair this post with the [data residency guide](https://www.joinhorizon.co/blog/aws-data-residency-sovereignty-guide-2026/), since Outposts and Local Zones satisfy different auditor questions. ## What to do this week 1. Measure **p99 RTT** from target metros to parent Region and document it before buying hardware. 2. Check **Local Zone availability** in those metros; run one latency-sensitive API there. 3. Inventory **workloads that truly need your floor** (HSM, OT bridge) vs cacheable reads. 4. Validate **DX + VPN + TGW** against the connectivity checklist. 5. If considering Wavelength, get **carrier sign-off** before architecture review closes. ## What this post doesn't cover - **Snow Family bulk migration:** see [migration cost surprises](https://www.joinhorizon.co/blog/aws-migration-without-cost-surprises/). - **Factory OT / OPC-UA** edge: [OT/IT convergence](https://www.joinhorizon.co/blog/ot-it-convergence-aws-architecture-patterns/). - **EC2 vs Lambda cost break-even:** [hybrid compute guide](https://www.joinhorizon.co/blog/hybrid-compute-ec2-serverless-cost-efficiency/). - **Full telco 5G core design:** requires carrier engineering beyond AWS docs. **Related:** [VPC networking](https://www.joinhorizon.co/blog/aws-vpc-networking-best-practices-for-production/) · [Cross-account patterns](https://www.joinhorizon.co/blog/aws-cross-account-patterns-beyond-landing-zone-2026/) · [Managed services](https://www.joinhorizon.co/services/aws-managed-services/) ## FAQ ### What is the difference between AWS Local Zones and Outposts? Local Zones are AWS-owned and operated infrastructure extensions in large metropolitan areas. You deploy into a Local Zone subnet in the parent Region VPC, but compute runs physically closer to metro users. Outposts are AWS-managed hardware installed in your datacenter or colocation facility (42U racks or 1U/2U servers); you host the metal and AWS manages software and lifecycle. Choose Local Zones when AWS-operated metro placement satisfies latency and residency; choose Outposts when auditors require workloads on your raised floor or you need physical proximity to existing HSMs or OT gear. ### When should we use AWS Wavelength? Use Wavelength when you have a carrier partnership and a 5G/MEC use case that requires single-digit millisecond latency from handsets to compute, such as video distribution at the tower edge, real-time gaming, or industrial AR with mobility. Wavelength embeds AWS compute in telco data centers. Without a signed carrier path and handset routing design, Wavelength zones are idle capacity. Do not choose Wavelength for generic API hosting that CloudFront and a Regional ALB already satisfy. ### When should we NOT buy AWS Outposts? Skip Outposts when a Local Zone in the same metro meets latency and compliance, because racks add capex, power, colo contracts, and service-link bandwidth planning. Skip when your workload is batch ETL or internal admin tools with no user-facing latency SLO. Skip when the goal is "future-proofing" without measured p99 from the parent Region. Buy Outposts when residency law or hardware affinity (HSM, legacy PCI appliance) truly requires your floor. ### How does this differ from hybrid compute (EC2 + Lambda)? Hybrid compute decides which compute primitive runs a workload shape (EC2 vs Lambda vs Fargate, based on utilization and cold starts). Hybrid edge decides where that compute physically runs (parent Region vs Local Zone vs Outposts vs Wavelength) and how packets reach it over Direct Connect and Transit Gateway. You need both decisions, but they are orthogonal. Read the hybrid compute guide for invocation economics; this post is for placement and networking. ### What bandwidth does Outposts need to the parent Region? AWS recommends redundant connectivity of at least 500 Mbps to 1 Gbps for the Outposts service link to the parent Region. Management and workload traffic share that path. Undersized circuits cause control-plane instability before user traffic spikes. Model VPN backup on a separate path, and do not rely on a single Direct Connect circuit without failover. ### What could go wrong during hybrid rollout? Three recurring failures: (1) Overlapping CIDR between on-prem and Outposts VPC breaks routing silently after cutover. (2) Local Zone workloads call Regional-only services (certain RDS shapes) and latency surprises appear on control-plane APIs, not user paths. (3) Wavelength deployed without carrier NOC integration, so handsets never route to the edge ENI. Use the connectivity checklist before production traffic. --- *Source: https://www.joinhorizon.co/blog/aws-hybrid-edge-integration-outposts-local-zones-wavelength-2026/*