An enterprise runs 40 microservices across three VPCs and two accounts using ECS and Lambda, needing identity-aware HTTP routing, fine-grained access, and unified observability without sidecar proxies to manage. East-west traffic must scale without Transit Gateway peering sprawl. Which service mesh design for microservice communication and observability should the architect adopt?
Select an answer to reveal the explanation.
Short Explanation
You need city streets, not private driveways between houses. VPC Lattice as a mesh is like managed highways — one network, clear signs, built-in toll logs.
Full Explanation
Amazon VPC Lattice fits because service networks enable identity-aware HTTP routing across three VPCs and two accounts with IAM-based access policies and centralized metrics and access logs without managing sidecars, supporting both ECS and Lambda targets so east-west traffic scales without Transit Gateway complexity. AWS App Mesh with Envoy sidecars delivers similar Layer 7 routing, mTLS and observability, but it violates the explicit no-sidecar constraint by requiring Envoy proxies per task, and AWS closed it to new customers in 2024 and ends support on September 30, 2026, pointing users to ECS Service Connect or VPC Lattice. Centralized Transit Gateway routing with shared internal load balancers is a standard multi-VPC pattern providing reliable network connectivity with security groups and CloudWatch, but it operates at L3/L4 and retains peering and route-table sprawl without native service-level identity and fine-grained access policy. ECS Service Connect with Cloud Map namespaces provides effective agentless discovery, routing and telemetry without sidecars, but it is ECS-centric and VPC-scoped and cannot uniformly integrate Lambda functions across multiple VPCs and accounts. For exams, distinguish service networks from transit when identity and policy lead. Before adoption, validate associations, auth policies and target registrations for ECS and Lambda in staging.