Ten Weeks to Get Off App Mesh
On September 30, AWS turns off App Mesh. That’s no longer a deprecation warning. It’s a shutdown date.
- Date
- Topic
- Migration
- Sources
- 6
- Reading time
- 2 min
- Version
- Translation
Before anyone touches YAML, the honest question about the destination. If you’re ECS-native, go with Service Connect: that’s the official AWS path and the right answer for that case. If you run on EKS, connect multiple clusters, or have hard mTLS and policy requirements, you need a real mesh. That case is what the rest of this report is about, and the destination is Istio.
Figure as text
Graphic in three zones: a step-zero decision question (ECS-native points to Service Connect, EKS, multi-cluster, or mTLS requirements point to Istio), a five-row mapping table from App Mesh resources to their Istio counterparts with a callout on the naming trap, and a phased migration timeline with the September 30 EOL mark and a config_dump acceptance test.
The good news from the last two weeks: both systems run the same engine. A Virtual Node becomes a Deployment with sidecar injection. Virtual Router and Routes become a VirtualService, match rules and traffic split included. The subsets end up in the DestinationRule. The Virtual Gateway becomes an Istio Gateway. One trap up front: App Mesh’s Virtual Service and Istio’s VirtualService share the name, not the role. The full table is in the image.
And because Envoy works underneath both, there’s an acceptance test better than any gut feeling: the config_dump. Same listeners, same routes, same clusters before and after, and the move was correct. The four questions from report #12 are your test protocol.
The scaffold for it: inventory, which App Mesh objects actually exist. Parallel operation, run Istio alongside it rather than underneath it. Then migrate workload by workload and compare the telemetry, you know istio_requests_total from report #9. At the end, teardown, with proof instead of hope.
Where it hurts: retry and timeout defaults are not identical. The match semantics of the Routes don’t translate one-to-one. Egress behaves differently once REGISTRY_ONLY enters the picture. These are the places where a weekend project turns into a quarter.
The scaffold is the generic part, that one is on me. The specific part is your setup. If the countdown affects you and you want a target state or a second pair of eyes on the mapping: reach out, a DM is enough.
In July, this is a project. In September, it’s an emergency.
