Skip to content
~/sph.sh

Cloud Computing · 4 / 4 posts

Serverless Internal Service Layer: A Mesh You Compose, Not Deploy

Building service-mesh-like east-west communication for a multi-team serverless estate on a private API Gateway. Identity, encryption, wire formats, cost, and where the industry is actually heading.

Posts →

Series Overview

  1. 1. Build the Layer with a Private API Gateway
  2. 2. Identity and Encryption Between Services
  3. 3. gRPC, Protobuf, and the Wire Format
  4. 4. Cost, Overrides, and Where Meshes Are Heading

Published posts

Build an Internal Service Layer with a Private API Gateway

Stop granting lambda:InvokeFunction across teams. Build the replacement in CDK: a private REST API behind an execute-api VPC endpoint, gated by IAM SigV4.
Identity and Encryption Between Serverless Services

SigV4 proves which service is calling and nothing about which user it is for. How to propagate a verified subject, and what the transport actually encrypts.
gRPC, Protobuf, and the Wire Format Your Gateway Allows

A private REST API structurally cannot carry gRPC, and every AWS surface that speaks gRPC excludes Lambda targets. What to keep from gRPC, and what to drop.
Cost, Overrides, and Where Service Meshes Are Heading

What the layer costs per call, the volume where VPC Lattice wins, and why AWS switching off App Mesh says the platform is absorbing the mesh.