---
title: Service Mesh Traffic Shifting: VPC Lattice, Istio on EKS, and App Mesh EOL
description: App Mesh is a legacy path. New meshes should start with VPC Lattice for AWS-native east-west or Istio on EKS when you need full L7 policy. Traffic shifting without duplicating load balancers per service.
url: https://www.joinhorizon.co/blog/service-mesh-traffic-shifting-vpc-lattice-istio-eks/
datePublished: 2026-06-12T00:00:00.000Z
dateModified: 2026-10-28T00:00:00.000Z
author: manojkumar-varatharajan
category: DevOps & CI/CD
tags: engineering-guide, kubernetes, eks, service-mesh, aws
---

# Service Mesh Traffic Shifting: VPC Lattice, Istio on EKS, and App Mesh EOL

> App Mesh is a legacy path. New meshes should start with VPC Lattice for AWS-native east-west or Istio on EKS when you need full L7 policy. Traffic shifting without duplicating load balancers per service.

**AWS App Mesh** is on a maintenance/EOL trajectory. As of **June 2026**, greenfield should evaluate **VPC Lattice** (service network across VPCs/accounts) and **Istio on EKS** for Kubernetes-native canary (Flagger, Argo Rollouts).

> **Benchmark pattern (hypothetical workload):** VPC Lattice weighted routing 90/10 canary across ECS services, no sidecar, p99 overhead 1.2ms; Istio on EKS mTLS + traffic split adds 3.8ms p99 sidecar tax; App Mesh EOL drives the Lattice migration path.

## Symptoms, mechanisms, and AWS controls

| Production symptom        | Mechanism                   | AWS control                                     |
| ------------------------- | --------------------------- | ----------------------------------------------- |
| Canary requires DNS hack  | No L7 traffic splitting     | VPC Lattice weighted target groups              |
| Sidecar resource overhead | Envoy per pod on Istio      | VPC Lattice (no sidecar) or ECS Service Connect |
| App Mesh deprecation risk | AWS App Mesh EOL trajectory | Migrate to VPC Lattice or Istio on EKS          |

**Opinionated take:** Default to VPC Lattice for AWS cross-service routing in 2026. Reach for Istio only when you need K8s-native mTLS and WASM extensibility.

## Traffic shifting patterns

| Tool                | Shift mechanism                |
| ------------------- | ------------------------------ |
| ECS/CodeDeploy      | Target group weights           |
| EKS + Istio         | VirtualService weights         |
| VPC Lattice         | Listener rules + target groups |
| ECS Service Connect | Simpler east-west for ECS-only |

**Sidecar limitations:** CPU/memory tax per pod. Measure before meshing 200 microservices.

## Service discovery

**Cloud Map** + DNS for ECS; **CoreDNS** for EKS; Lattice provides **named services** without Consul cluster ops.

## AWS services map

| Need                         | Service             | Skip when                               |
| ---------------------------- | ------------------- | --------------------------------------- |
| AWS-native service mesh      | VPC Lattice         | Need K8s-only ingress without cross-VPC |
| K8s mTLS + advanced routing  | Istio on EKS        | Two services, ALB path routing suffices |
| ECS service discovery + mesh | ECS Service Connect | Monolith with no east-west traffic      |

## What to do this week

1. Inventory App Mesh usage and plan a Lattice or Istio migration.
2. Pilot 5% canary with weighted targets on non-critical API.
3. Compare p99 latency with/without sidecar on same node pool.

## More in This Track

Part of the **Engineering Guides** library (June 2026).

- Previous: [Part 2](https://www.joinhorizon.co/blog/kubernetes-pod-disruption-budgets-eks-zero-downtime/)
- Next: [Part 4](https://www.joinhorizon.co/blog/container-runtime-security-seccomp-apparmor-eks-fargate/)
- Browse tracks: [Engineering Guides hub](https://www.joinhorizon.co/resources/engineering-guides/)

## What this guide doesn't cover

Container seccomp is covered in part 4 of this track.

## FAQ

### Should new AWS meshes start on App Mesh in 2026?
No. App Mesh is on a maintenance/EOL path. Greenfield should evaluate VPC Lattice for AWS-native east-west and Istio on EKS when you need Kubernetes mTLS, WASM, or Flagger/Argo canaries.

### When is Istio the wrong default versus VPC Lattice?
Default to Lattice for cross-VPC/account routing without a sidecar. Reach for Istio when you need K8s-native mTLS and extensibility. Two services behind an ALB path rule do not need a mesh. ECS-only fleets can use Service Connect.

### What could go wrong if I mesh 200 microservices on day one?
Envoy sidecar CPU and memory tax. Measure p99 with and without the sidecar on the same node pool before you blanket-mesh. Lattice weighted targets avoid that tax for AWS-native splits.

### Does Cloud Map replace Lattice named services?
Cloud Map plus DNS still works for ECS discovery. Lattice adds a service network and listener rules without running Consul. Use the tool that matches VPC/account span, not both as a double control plane.

---

*Source: https://www.joinhorizon.co/blog/service-mesh-traffic-shifting-vpc-lattice-istio-eks/*