Skip to content
~/sph.sh

Cloud Computing · 7 / 7 posts

Serverless Internal Service Layer: A Mesh You Compose, Not Deploy

Building service-mesh-like east-west communication for a multi-team serverless estate on a private API Gateway. Identity, encryption, wire formats, cost, and where the industry is actually heading.

Posts →

Series Overview

  1. 1. Choosing a Serverless Internal Service Layer
  2. 2. gRPC, Protobuf, and the Wire Format
  3. 3. Building the Layer with a Private API Gateway
  4. 4. Identity and Encryption Between Services
  5. 5. Multi-Account and the Data Perimeter
  6. 6. How the Layer Fails
  7. 7. Observability, and Where Service Meshes Are Heading

Published posts

Choosing a Serverless Internal Service Layer

Before building an internal service layer, decide whether to. What the layer costs per call, the volume where VPC Lattice wins, and when direct invoke still beats it.
gRPC, Protobuf, and the Wire Format Your Gateway Allows

A private REST API structurally cannot carry gRPC, and every AWS surface that speaks gRPC excludes Lambda targets. What to keep from gRPC, and what to drop.
Building the Layer with a Private API Gateway

The private REST API, the resource policy that switches it on, per-route AWS_IAM grants, the two CDK stacks, and signing the call from a Node 22 Lambda.
Identity and Encryption Between Serverless Services

SigV4 proves which service is calling and nothing about which user it is for. How to propagate a verified subject, and what the transport actually encrypts.
Multi-Account: Cross-Account Calls and the Data Perimeter

Same-account, the resource policy and the caller's identity policy are an OR. Cross-account they become an AND, and silence denies. What that changes in the perimeter.
How the Layer Fails: Throttles, Retries, and Loops

API Gateway shares one throttle bucket with your front door, never retries a Lambda integration, and cannot see loops through itself. What you have to rebuild.
Observability, and Where Service Meshes Are Heading

The access log already names the caller, route, and latency. Per-route metrics are not free, the user token needs masking, and AWS is switching off its own mesh.