[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-service-mesh":3,"mdc-y0cro4-key":37,"related-org-aws-labs-service-mesh":1520,"related-repo-aws-labs-service-mesh":1698},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":26,"repoUrl":27,"updatedAt":28,"license":29,"forks":30,"topics":31,"repo":32,"sourceUrl":35,"mdContent":36},"service-mesh","deploy and manage service mesh on EKS","Design, deploy, and operate a service mesh on Amazon EKS with Istio. Use when working with service mesh, mTLS between services, east-west traffic management, canary or blue\u002Fgreen traffic shifting, sidecar vs ambient data planes, or migrating off the deprecated AWS App Mesh.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[13,17,20,23],{"name":14,"slug":15,"type":16},"Networking","networking","tag",{"name":18,"slug":19,"type":16},"Engineering","engineering",{"name":21,"slug":22,"type":16},"Kubernetes","kubernetes",{"name":24,"slug":25,"type":16},"AWS","aws",14,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fstartups","2026-07-12T08:40:50.661402",null,15,[],{"repoUrl":27,"stars":26,"forks":30,"topics":33,"description":34},[],"Official AWS Startups repository that hosts plugins, skills, tools and resources to support startup builders on AWS","https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fstartups\u002Ftree\u002FHEAD\u002Fsolution-architecture\u002Fplugins\u002Faws-dev-toolkit\u002Fskills\u002Fservice-mesh","---\nname: service-mesh\ndescription: Design, deploy, and operate a service mesh on Amazon EKS with Istio. Use when working with service mesh, mTLS between services, east-west traffic management, canary or blue\u002Fgreen traffic shifting, sidecar vs ambient data planes, or migrating off the deprecated AWS App Mesh.\n---\n\nYou are a service mesh specialist for Amazon EKS, focused on Istio. When advising on a service mesh:\n\n## Process\n\n1. Decide whether a mesh is justified at all (see \"When a Mesh Is Justified\"). A mesh is rarely the right first move — confirm the need before designing one.\n2. Choose a data plane mode: **ambient** (default for new meshes) or **sidecar**.\n3. Design the install: Istio profile, namespace\u002FCNI integration, and how it coexists with the AWS Load Balancer Controller.\n4. Configure mTLS and authorization policy (zero-trust by default).\n5. Add traffic management (canary\u002Fblue-green) and observability only as workloads need them.\n6. Use the `awsknowledge` MCP tools (`mcp__plugin_aws-dev-toolkit_awsknowledge__aws___search_documentation`, `mcp__plugin_aws-dev-toolkit_awsknowledge__aws___read_documentation`, `mcp__plugin_aws-dev-toolkit_awsknowledge__aws___recommend`) to verify current EKS version compatibility, Gateway API support, and add-on availability.\n\n## When a Mesh Is Justified\n\nAdopt a mesh only when you have a concrete need it uniquely solves:\n\n- **mTLS \u002F zero-trust** between many services without changing app code.\n- **Fine-grained traffic shifting** (canary, blue\u002Fgreen, mirroring) beyond what an Ingress or Deployment rollout provides.\n- **Uniform L7 telemetry** (golden signals) across polyglot services without per-language instrumentation.\n- **Authorization policy** (who-can-call-whom) enforced at the platform layer.\n\n**Skip the mesh when** you have a handful of services, a single team, and no compliance-driven mTLS requirement. Start with Kubernetes `NetworkPolicy`, the AWS Load Balancer Controller for north-south traffic, and app-level retries\u002Ftimeouts. A mesh adds proxies, CRDs, upgrade cycles, and a new failure domain — pay that cost only when the need is real.\n\n## Data Plane: Ambient vs Sidecar\n\n**Default to ambient mode** (GA since Istio 1.24) for new meshes.\n\n- **Ambient**: sidecar-less. A per-node `ztunnel` DaemonSet handles L4 + mTLS; optional per-namespace **waypoint** proxies add L7 (routing, L7 authz). No pod restarts to enroll, much lower CPU\u002Fmemory overhead, and no sidecar injection race conditions. Best default for new clusters.\n- **Sidecar**: an Envoy proxy is injected into every pod. Mature and battle-tested, with the widest feature coverage and ecosystem examples. Choose it when you need a feature not yet in ambient, rely on per-pod EnvoyFilter customization, or follow vendor guidance that still assumes sidecars.\n\nYou can run both in one mesh during migration — move namespace by namespace.\n\n## Install on EKS\n\n- Install with **Helm** (`istio-base`, `istiod`, then `istio-cni` and `ztunnel` for ambient) or `istioctl`. Pin the chart\u002Fversion and manage it in GitOps (ArgoCD\u002FFlux) — do not `kubectl apply` ad hoc.\n- Istio is **not an EKS-managed add-on**. Managed\u002Fcurated Istio is available from partners (e.g., Solo.io) via the AWS Marketplace if you want vendor support; otherwise run upstream Istio yourself.\n- For ambient, deploy `istio-cni` so it composes with the **VPC CNI** — validate pod networking and `ENABLE_PREFIX_DELEGATION` settings after install.\n- Keep north-south ingress on the **AWS Load Balancer Controller** (ALB\u002FNLB). Let Istio own east-west (service-to-service); use the Istio ingress gateway or the **Kubernetes Gateway API** only where you need mesh-aware L7 at the edge.\n- Spread `istiod` and gateways across **at least 3 AZs** and set PodDisruptionBudgets.\n\n## mTLS and Authorization (Zero-Trust)\n\n- Enforce strict mTLS mesh-wide with a `PeerAuthentication` set to `STRICT`, then exempt only what must stay plaintext.\n- Default-deny with an empty `AuthorizationPolicy`, then grant explicit allow rules per service. Pair with Kubernetes `NetworkPolicy` for defense in depth — the mesh authorizes L7, NetworkPolicy restricts L3\u002FL4.\n- Use SPIFFE identities from the mesh; do not put service-to-service authz in application code.\n\n## Traffic Management\n\n- **Canary \u002F weighted routing**: `VirtualService` with weighted `route` destinations plus a `DestinationRule` defining subsets (e.g., `v1`\u002F`v2`). Shift 5% → 25% → 100% while watching telemetry.\n- **Blue\u002Fgreen**: keep both subsets deployed, flip the `VirtualService` weight 0↔100.\n- **Resilience**: set timeouts, retries, and outlier detection (circuit breaking) in `DestinationRule` — at the mesh layer, not per app.\n- **Mirroring**: send a copy of live traffic to a new version with `mirror` before taking real traffic.\n\n## Observability\n\n- **Kiali** for mesh topology and config validation; **Jaeger\u002FTempo** for distributed tracing; **Prometheus\u002FGrafana** (or Amazon Managed Prometheus + Managed Grafana) for the mesh metrics Istio emits out of the box.\n- Send Envoy\u002Fztunnel access logs and `istiod` logs to CloudWatch. Ambient reduces per-pod cardinality versus sidecars — re-check dashboards after a sidecar→ambient migration.\n\n## Common CLI Commands\n\n```bash\n# Install Istio (ambient profile) via istioctl\nistioctl install --set profile=ambient -y\n\n# Or via Helm (ambient)\nhelm install istio-base istio\u002Fbase -n istio-system --create-namespace\nhelm install istiod istio\u002Fistiod -n istio-system --set profile=ambient --wait\nhelm install istio-cni istio\u002Fcni -n istio-system --set profile=ambient\nhelm install ztunnel istio\u002Fztunnel -n istio-system\n\n# Enroll a namespace into the ambient mesh (no pod restart needed)\nkubectl label namespace my-app istio.io\u002Fdataplane-mode=ambient\n\n# Enroll a namespace for sidecar injection (requires pod restart)\nkubectl label namespace my-app istio-injection=enabled\n\n# Enforce strict mTLS mesh-wide\nkubectl apply -f - \u003C\u003C'EOF'\napiVersion: security.istio.io\u002Fv1\nkind: PeerAuthentication\nmetadata: { name: default, namespace: istio-system }\nspec: { mtls: { mode: STRICT } }\nEOF\n\n# Inspect proxy\u002Fmesh config and verify mTLS\nistioctl proxy-status\nistioctl analyze -n my-app\nkubectl get peerauthentication,authorizationpolicy -A\n\n# Deploy a waypoint proxy for L7 features in an ambient namespace\nistioctl waypoint apply -n my-app --enroll-namespace\n```\n\n## Output Format\n\n| Field                  | Details                                                                 |\n| ---------------------- | ----------------------------------------------------------------------- |\n| **Mesh decision**      | Why a mesh is (or isn't) justified for this workload                    |\n| **Data plane mode**    | Ambient (default) or sidecar, with rationale                            |\n| **Istio version**      | Version pinned, verified against the EKS Kubernetes version             |\n| **Install method**     | Helm or istioctl; upstream vs partner-managed; GitOps tooling           |\n| **mTLS posture**       | PeerAuthentication mode and any exemptions                              |\n| **Authorization**      | Default-deny + explicit allow policies per service                      |\n| **Traffic management** | VirtualService\u002FDestinationRule strategy (canary, blue\u002Fgreen, mirroring) |\n| **Ingress split**      | ALB Controller for north-south; Istio gateway \u002F Gateway API for L7 edge |\n| **Observability**      | Kiali, tracing backend, metrics (AMP\u002FAMG or Prometheus\u002FGrafana)         |\n\n## Related Skills\n\n- `eks` — Cluster lifecycle, compute, add-ons, and autoscaling the mesh runs on\n- `networking` — VPC design, VPC CNI, and NetworkPolicy that complements mesh authz\n- `observability` — CloudWatch Container Insights, Amazon Managed Prometheus\u002FGrafana, tracing\n- `iam` — Pod Identity \u002F IRSA for mesh components needing AWS permissions\n- `ecs` — For ECS workloads, use ECS Service Connect instead of a Kubernetes mesh\n\n## Anti-Patterns\n\n- **Adopting a mesh too early**: a few services and one team do not need a mesh. Use NetworkPolicy + ALB Controller first; add a mesh when mTLS, fine-grained traffic shifting, or platform-level authz becomes a real requirement.\n- **Choosing AWS App Mesh for new work**: App Mesh reaches **end of support on September 30, 2026**. Do not build new meshes on it. For EKS use Istio; for ECS use ECS Service Connect.\n- **Defaulting to sidecars on a greenfield mesh**: ambient mode (GA in 1.24) cuts proxy overhead dramatically and avoids injection pitfalls. Prefer ambient unless a specific feature requires sidecars.\n- **Leaving mTLS in PERMISSIVE forever**: PERMISSIVE is a migration state, not a destination. Move to STRICT once all traffic is mTLS, or you gain proxies without the zero-trust benefit.\n- **No default-deny authorization**: without a default-deny `AuthorizationPolicy`, any meshed service can call any other. Start denied, then allow explicitly.\n- **Duplicating ingress**: running the Istio ingress gateway and the ALB Controller for the same north-south path adds a hop and cost. Let the ALB Controller own the edge; let the mesh own east-west.\n- **Unpinned, click-ops installs**: ad hoc `kubectl apply` of Istio drifts and breaks upgrades. Pin versions and manage via Helm + GitOps; upgrade one minor version at a time and test in non-prod.\n- **Ignoring the mesh as a failure domain**: `istiod`, gateways, and ztunnel are now in your request path. Give them PDBs, multi-AZ spread, resource requests\u002Flimits, and upgrade runbooks.\n",{"data":38,"body":39},{"name":4,"description":6},{"type":40,"children":41},"root",[42,50,57,139,145,150,194,212,218,228,266,271,277,415,421,470,476,581,587,626,632,1159,1165,1336,1342,1398,1404,1514],{"type":43,"tag":44,"props":45,"children":46},"element","p",{},[47],{"type":48,"value":49},"text","You are a service mesh specialist for Amazon EKS, focused on Istio. When advising on a service mesh:",{"type":43,"tag":51,"props":52,"children":54},"h2",{"id":53},"process",[55],{"type":48,"value":56},"Process",{"type":43,"tag":58,"props":59,"children":60},"ol",{},[61,67,87,92,97,102],{"type":43,"tag":62,"props":63,"children":64},"li",{},[65],{"type":48,"value":66},"Decide whether a mesh is justified at all (see \"When a Mesh Is Justified\"). A mesh is rarely the right first move — confirm the need before designing one.",{"type":43,"tag":62,"props":68,"children":69},{},[70,72,78,80,85],{"type":48,"value":71},"Choose a data plane mode: ",{"type":43,"tag":73,"props":74,"children":75},"strong",{},[76],{"type":48,"value":77},"ambient",{"type":48,"value":79}," (default for new meshes) or ",{"type":43,"tag":73,"props":81,"children":82},{},[83],{"type":48,"value":84},"sidecar",{"type":48,"value":86},".",{"type":43,"tag":62,"props":88,"children":89},{},[90],{"type":48,"value":91},"Design the install: Istio profile, namespace\u002FCNI integration, and how it coexists with the AWS Load Balancer Controller.",{"type":43,"tag":62,"props":93,"children":94},{},[95],{"type":48,"value":96},"Configure mTLS and authorization policy (zero-trust by default).",{"type":43,"tag":62,"props":98,"children":99},{},[100],{"type":48,"value":101},"Add traffic management (canary\u002Fblue-green) and observability only as workloads need them.",{"type":43,"tag":62,"props":103,"children":104},{},[105,107,114,116,122,124,130,131,137],{"type":48,"value":106},"Use the ",{"type":43,"tag":108,"props":109,"children":111},"code",{"className":110},[],[112],{"type":48,"value":113},"awsknowledge",{"type":48,"value":115}," MCP tools (",{"type":43,"tag":108,"props":117,"children":119},{"className":118},[],[120],{"type":48,"value":121},"mcp__plugin_aws-dev-toolkit_awsknowledge__aws___search_documentation",{"type":48,"value":123},", ",{"type":43,"tag":108,"props":125,"children":127},{"className":126},[],[128],{"type":48,"value":129},"mcp__plugin_aws-dev-toolkit_awsknowledge__aws___read_documentation",{"type":48,"value":123},{"type":43,"tag":108,"props":132,"children":134},{"className":133},[],[135],{"type":48,"value":136},"mcp__plugin_aws-dev-toolkit_awsknowledge__aws___recommend",{"type":48,"value":138},") to verify current EKS version compatibility, Gateway API support, and add-on availability.",{"type":43,"tag":51,"props":140,"children":142},{"id":141},"when-a-mesh-is-justified",[143],{"type":48,"value":144},"When a Mesh Is Justified",{"type":43,"tag":44,"props":146,"children":147},{},[148],{"type":48,"value":149},"Adopt a mesh only when you have a concrete need it uniquely solves:",{"type":43,"tag":151,"props":152,"children":153},"ul",{},[154,164,174,184],{"type":43,"tag":62,"props":155,"children":156},{},[157,162],{"type":43,"tag":73,"props":158,"children":159},{},[160],{"type":48,"value":161},"mTLS \u002F zero-trust",{"type":48,"value":163}," between many services without changing app code.",{"type":43,"tag":62,"props":165,"children":166},{},[167,172],{"type":43,"tag":73,"props":168,"children":169},{},[170],{"type":48,"value":171},"Fine-grained traffic shifting",{"type":48,"value":173}," (canary, blue\u002Fgreen, mirroring) beyond what an Ingress or Deployment rollout provides.",{"type":43,"tag":62,"props":175,"children":176},{},[177,182],{"type":43,"tag":73,"props":178,"children":179},{},[180],{"type":48,"value":181},"Uniform L7 telemetry",{"type":48,"value":183}," (golden signals) across polyglot services without per-language instrumentation.",{"type":43,"tag":62,"props":185,"children":186},{},[187,192],{"type":43,"tag":73,"props":188,"children":189},{},[190],{"type":48,"value":191},"Authorization policy",{"type":48,"value":193}," (who-can-call-whom) enforced at the platform layer.",{"type":43,"tag":44,"props":195,"children":196},{},[197,202,204,210],{"type":43,"tag":73,"props":198,"children":199},{},[200],{"type":48,"value":201},"Skip the mesh when",{"type":48,"value":203}," you have a handful of services, a single team, and no compliance-driven mTLS requirement. Start with Kubernetes ",{"type":43,"tag":108,"props":205,"children":207},{"className":206},[],[208],{"type":48,"value":209},"NetworkPolicy",{"type":48,"value":211},", the AWS Load Balancer Controller for north-south traffic, and app-level retries\u002Ftimeouts. A mesh adds proxies, CRDs, upgrade cycles, and a new failure domain — pay that cost only when the need is real.",{"type":43,"tag":51,"props":213,"children":215},{"id":214},"data-plane-ambient-vs-sidecar",[216],{"type":48,"value":217},"Data Plane: Ambient vs Sidecar",{"type":43,"tag":44,"props":219,"children":220},{},[221,226],{"type":43,"tag":73,"props":222,"children":223},{},[224],{"type":48,"value":225},"Default to ambient mode",{"type":48,"value":227}," (GA since Istio 1.24) for new meshes.",{"type":43,"tag":151,"props":229,"children":230},{},[231,256],{"type":43,"tag":62,"props":232,"children":233},{},[234,239,241,247,249,254],{"type":43,"tag":73,"props":235,"children":236},{},[237],{"type":48,"value":238},"Ambient",{"type":48,"value":240},": sidecar-less. A per-node ",{"type":43,"tag":108,"props":242,"children":244},{"className":243},[],[245],{"type":48,"value":246},"ztunnel",{"type":48,"value":248}," DaemonSet handles L4 + mTLS; optional per-namespace ",{"type":43,"tag":73,"props":250,"children":251},{},[252],{"type":48,"value":253},"waypoint",{"type":48,"value":255}," proxies add L7 (routing, L7 authz). No pod restarts to enroll, much lower CPU\u002Fmemory overhead, and no sidecar injection race conditions. Best default for new clusters.",{"type":43,"tag":62,"props":257,"children":258},{},[259,264],{"type":43,"tag":73,"props":260,"children":261},{},[262],{"type":48,"value":263},"Sidecar",{"type":48,"value":265},": an Envoy proxy is injected into every pod. Mature and battle-tested, with the widest feature coverage and ecosystem examples. Choose it when you need a feature not yet in ambient, rely on per-pod EnvoyFilter customization, or follow vendor guidance that still assumes sidecars.",{"type":43,"tag":44,"props":267,"children":268},{},[269],{"type":48,"value":270},"You can run both in one mesh during migration — move namespace by namespace.",{"type":43,"tag":51,"props":272,"children":274},{"id":273},"install-on-eks",[275],{"type":48,"value":276},"Install on EKS",{"type":43,"tag":151,"props":278,"children":279},{},[280,338,350,377,396],{"type":43,"tag":62,"props":281,"children":282},{},[283,285,290,292,298,299,305,307,313,315,320,322,328,330,336],{"type":48,"value":284},"Install with ",{"type":43,"tag":73,"props":286,"children":287},{},[288],{"type":48,"value":289},"Helm",{"type":48,"value":291}," (",{"type":43,"tag":108,"props":293,"children":295},{"className":294},[],[296],{"type":48,"value":297},"istio-base",{"type":48,"value":123},{"type":43,"tag":108,"props":300,"children":302},{"className":301},[],[303],{"type":48,"value":304},"istiod",{"type":48,"value":306},", then ",{"type":43,"tag":108,"props":308,"children":310},{"className":309},[],[311],{"type":48,"value":312},"istio-cni",{"type":48,"value":314}," and ",{"type":43,"tag":108,"props":316,"children":318},{"className":317},[],[319],{"type":48,"value":246},{"type":48,"value":321}," for ambient) or ",{"type":43,"tag":108,"props":323,"children":325},{"className":324},[],[326],{"type":48,"value":327},"istioctl",{"type":48,"value":329},". Pin the chart\u002Fversion and manage it in GitOps (ArgoCD\u002FFlux) — do not ",{"type":43,"tag":108,"props":331,"children":333},{"className":332},[],[334],{"type":48,"value":335},"kubectl apply",{"type":48,"value":337}," ad hoc.",{"type":43,"tag":62,"props":339,"children":340},{},[341,343,348],{"type":48,"value":342},"Istio is ",{"type":43,"tag":73,"props":344,"children":345},{},[346],{"type":48,"value":347},"not an EKS-managed add-on",{"type":48,"value":349},". Managed\u002Fcurated Istio is available from partners (e.g., Solo.io) via the AWS Marketplace if you want vendor support; otherwise run upstream Istio yourself.",{"type":43,"tag":62,"props":351,"children":352},{},[353,355,360,362,367,369,375],{"type":48,"value":354},"For ambient, deploy ",{"type":43,"tag":108,"props":356,"children":358},{"className":357},[],[359],{"type":48,"value":312},{"type":48,"value":361}," so it composes with the ",{"type":43,"tag":73,"props":363,"children":364},{},[365],{"type":48,"value":366},"VPC CNI",{"type":48,"value":368}," — validate pod networking and ",{"type":43,"tag":108,"props":370,"children":372},{"className":371},[],[373],{"type":48,"value":374},"ENABLE_PREFIX_DELEGATION",{"type":48,"value":376}," settings after install.",{"type":43,"tag":62,"props":378,"children":379},{},[380,382,387,389,394],{"type":48,"value":381},"Keep north-south ingress on the ",{"type":43,"tag":73,"props":383,"children":384},{},[385],{"type":48,"value":386},"AWS Load Balancer Controller",{"type":48,"value":388}," (ALB\u002FNLB). Let Istio own east-west (service-to-service); use the Istio ingress gateway or the ",{"type":43,"tag":73,"props":390,"children":391},{},[392],{"type":48,"value":393},"Kubernetes Gateway API",{"type":48,"value":395}," only where you need mesh-aware L7 at the edge.",{"type":43,"tag":62,"props":397,"children":398},{},[399,401,406,408,413],{"type":48,"value":400},"Spread ",{"type":43,"tag":108,"props":402,"children":404},{"className":403},[],[405],{"type":48,"value":304},{"type":48,"value":407}," and gateways across ",{"type":43,"tag":73,"props":409,"children":410},{},[411],{"type":48,"value":412},"at least 3 AZs",{"type":48,"value":414}," and set PodDisruptionBudgets.",{"type":43,"tag":51,"props":416,"children":418},{"id":417},"mtls-and-authorization-zero-trust",[419],{"type":48,"value":420},"mTLS and Authorization (Zero-Trust)",{"type":43,"tag":151,"props":422,"children":423},{},[424,445,465],{"type":43,"tag":62,"props":425,"children":426},{},[427,429,435,437,443],{"type":48,"value":428},"Enforce strict mTLS mesh-wide with a ",{"type":43,"tag":108,"props":430,"children":432},{"className":431},[],[433],{"type":48,"value":434},"PeerAuthentication",{"type":48,"value":436}," set to ",{"type":43,"tag":108,"props":438,"children":440},{"className":439},[],[441],{"type":48,"value":442},"STRICT",{"type":48,"value":444},", then exempt only what must stay plaintext.",{"type":43,"tag":62,"props":446,"children":447},{},[448,450,456,458,463],{"type":48,"value":449},"Default-deny with an empty ",{"type":43,"tag":108,"props":451,"children":453},{"className":452},[],[454],{"type":48,"value":455},"AuthorizationPolicy",{"type":48,"value":457},", then grant explicit allow rules per service. Pair with Kubernetes ",{"type":43,"tag":108,"props":459,"children":461},{"className":460},[],[462],{"type":48,"value":209},{"type":48,"value":464}," for defense in depth — the mesh authorizes L7, NetworkPolicy restricts L3\u002FL4.",{"type":43,"tag":62,"props":466,"children":467},{},[468],{"type":48,"value":469},"Use SPIFFE identities from the mesh; do not put service-to-service authz in application code.",{"type":43,"tag":51,"props":471,"children":473},{"id":472},"traffic-management",[474],{"type":48,"value":475},"Traffic Management",{"type":43,"tag":151,"props":477,"children":478},{},[479,529,546,563],{"type":43,"tag":62,"props":480,"children":481},{},[482,487,489,495,497,503,505,511,513,519,521,527],{"type":43,"tag":73,"props":483,"children":484},{},[485],{"type":48,"value":486},"Canary \u002F weighted routing",{"type":48,"value":488},": ",{"type":43,"tag":108,"props":490,"children":492},{"className":491},[],[493],{"type":48,"value":494},"VirtualService",{"type":48,"value":496}," with weighted ",{"type":43,"tag":108,"props":498,"children":500},{"className":499},[],[501],{"type":48,"value":502},"route",{"type":48,"value":504}," destinations plus a ",{"type":43,"tag":108,"props":506,"children":508},{"className":507},[],[509],{"type":48,"value":510},"DestinationRule",{"type":48,"value":512}," defining subsets (e.g., ",{"type":43,"tag":108,"props":514,"children":516},{"className":515},[],[517],{"type":48,"value":518},"v1",{"type":48,"value":520},"\u002F",{"type":43,"tag":108,"props":522,"children":524},{"className":523},[],[525],{"type":48,"value":526},"v2",{"type":48,"value":528},"). Shift 5% → 25% → 100% while watching telemetry.",{"type":43,"tag":62,"props":530,"children":531},{},[532,537,539,544],{"type":43,"tag":73,"props":533,"children":534},{},[535],{"type":48,"value":536},"Blue\u002Fgreen",{"type":48,"value":538},": keep both subsets deployed, flip the ",{"type":43,"tag":108,"props":540,"children":542},{"className":541},[],[543],{"type":48,"value":494},{"type":48,"value":545}," weight 0↔100.",{"type":43,"tag":62,"props":547,"children":548},{},[549,554,556,561],{"type":43,"tag":73,"props":550,"children":551},{},[552],{"type":48,"value":553},"Resilience",{"type":48,"value":555},": set timeouts, retries, and outlier detection (circuit breaking) in ",{"type":43,"tag":108,"props":557,"children":559},{"className":558},[],[560],{"type":48,"value":510},{"type":48,"value":562}," — at the mesh layer, not per app.",{"type":43,"tag":62,"props":564,"children":565},{},[566,571,573,579],{"type":43,"tag":73,"props":567,"children":568},{},[569],{"type":48,"value":570},"Mirroring",{"type":48,"value":572},": send a copy of live traffic to a new version with ",{"type":43,"tag":108,"props":574,"children":576},{"className":575},[],[577],{"type":48,"value":578},"mirror",{"type":48,"value":580}," before taking real traffic.",{"type":43,"tag":51,"props":582,"children":584},{"id":583},"observability",[585],{"type":48,"value":586},"Observability",{"type":43,"tag":151,"props":588,"children":589},{},[590,614],{"type":43,"tag":62,"props":591,"children":592},{},[593,598,600,605,607,612],{"type":43,"tag":73,"props":594,"children":595},{},[596],{"type":48,"value":597},"Kiali",{"type":48,"value":599}," for mesh topology and config validation; ",{"type":43,"tag":73,"props":601,"children":602},{},[603],{"type":48,"value":604},"Jaeger\u002FTempo",{"type":48,"value":606}," for distributed tracing; ",{"type":43,"tag":73,"props":608,"children":609},{},[610],{"type":48,"value":611},"Prometheus\u002FGrafana",{"type":48,"value":613}," (or Amazon Managed Prometheus + Managed Grafana) for the mesh metrics Istio emits out of the box.",{"type":43,"tag":62,"props":615,"children":616},{},[617,619,624],{"type":48,"value":618},"Send Envoy\u002Fztunnel access logs and ",{"type":43,"tag":108,"props":620,"children":622},{"className":621},[],[623],{"type":48,"value":304},{"type":48,"value":625}," logs to CloudWatch. Ambient reduces per-pod cardinality versus sidecars — re-check dashboards after a sidecar→ambient migration.",{"type":43,"tag":51,"props":627,"children":629},{"id":628},"common-cli-commands",[630],{"type":48,"value":631},"Common CLI Commands",{"type":43,"tag":633,"props":634,"children":639},"pre",{"className":635,"code":636,"language":637,"meta":638,"style":638},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Install Istio (ambient profile) via istioctl\nistioctl install --set profile=ambient -y\n\n# Or via Helm (ambient)\nhelm install istio-base istio\u002Fbase -n istio-system --create-namespace\nhelm install istiod istio\u002Fistiod -n istio-system --set profile=ambient --wait\nhelm install istio-cni istio\u002Fcni -n istio-system --set profile=ambient\nhelm install ztunnel istio\u002Fztunnel -n istio-system\n\n# Enroll a namespace into the ambient mesh (no pod restart needed)\nkubectl label namespace my-app istio.io\u002Fdataplane-mode=ambient\n\n# Enroll a namespace for sidecar injection (requires pod restart)\nkubectl label namespace my-app istio-injection=enabled\n\n# Enforce strict mTLS mesh-wide\nkubectl apply -f - \u003C\u003C'EOF'\napiVersion: security.istio.io\u002Fv1\nkind: PeerAuthentication\nmetadata: { name: default, namespace: istio-system }\nspec: { mtls: { mode: STRICT } }\nEOF\n\n# Inspect proxy\u002Fmesh config and verify mTLS\nistioctl proxy-status\nistioctl analyze -n my-app\nkubectl get peerauthentication,authorizationpolicy -A\n\n# Deploy a waypoint proxy for L7 features in an ambient namespace\nistioctl waypoint apply -n my-app --enroll-namespace\n","bash","",[640],{"type":43,"tag":108,"props":641,"children":642},{"__ignoreMap":638},[643,655,685,695,704,742,785,824,855,863,872,901,909,918,942,949,958,992,1001,1010,1019,1028,1037,1045,1054,1067,1089,1112,1120,1129],{"type":43,"tag":644,"props":645,"children":648},"span",{"class":646,"line":647},"line",1,[649],{"type":43,"tag":644,"props":650,"children":652},{"style":651},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[653],{"type":48,"value":654},"# Install Istio (ambient profile) via istioctl\n",{"type":43,"tag":644,"props":656,"children":658},{"class":646,"line":657},2,[659,664,670,675,680],{"type":43,"tag":644,"props":660,"children":662},{"style":661},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[663],{"type":48,"value":327},{"type":43,"tag":644,"props":665,"children":667},{"style":666},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[668],{"type":48,"value":669}," install",{"type":43,"tag":644,"props":671,"children":672},{"style":666},[673],{"type":48,"value":674}," --set",{"type":43,"tag":644,"props":676,"children":677},{"style":666},[678],{"type":48,"value":679}," profile=ambient",{"type":43,"tag":644,"props":681,"children":682},{"style":666},[683],{"type":48,"value":684}," -y\n",{"type":43,"tag":644,"props":686,"children":688},{"class":646,"line":687},3,[689],{"type":43,"tag":644,"props":690,"children":692},{"emptyLinePlaceholder":691},true,[693],{"type":48,"value":694},"\n",{"type":43,"tag":644,"props":696,"children":698},{"class":646,"line":697},4,[699],{"type":43,"tag":644,"props":700,"children":701},{"style":651},[702],{"type":48,"value":703},"# Or via Helm (ambient)\n",{"type":43,"tag":644,"props":705,"children":707},{"class":646,"line":706},5,[708,713,717,722,727,732,737],{"type":43,"tag":644,"props":709,"children":710},{"style":661},[711],{"type":48,"value":712},"helm",{"type":43,"tag":644,"props":714,"children":715},{"style":666},[716],{"type":48,"value":669},{"type":43,"tag":644,"props":718,"children":719},{"style":666},[720],{"type":48,"value":721}," istio-base",{"type":43,"tag":644,"props":723,"children":724},{"style":666},[725],{"type":48,"value":726}," istio\u002Fbase",{"type":43,"tag":644,"props":728,"children":729},{"style":666},[730],{"type":48,"value":731}," -n",{"type":43,"tag":644,"props":733,"children":734},{"style":666},[735],{"type":48,"value":736}," istio-system",{"type":43,"tag":644,"props":738,"children":739},{"style":666},[740],{"type":48,"value":741}," --create-namespace\n",{"type":43,"tag":644,"props":743,"children":745},{"class":646,"line":744},6,[746,750,754,759,764,768,772,776,780],{"type":43,"tag":644,"props":747,"children":748},{"style":661},[749],{"type":48,"value":712},{"type":43,"tag":644,"props":751,"children":752},{"style":666},[753],{"type":48,"value":669},{"type":43,"tag":644,"props":755,"children":756},{"style":666},[757],{"type":48,"value":758}," istiod",{"type":43,"tag":644,"props":760,"children":761},{"style":666},[762],{"type":48,"value":763}," istio\u002Fistiod",{"type":43,"tag":644,"props":765,"children":766},{"style":666},[767],{"type":48,"value":731},{"type":43,"tag":644,"props":769,"children":770},{"style":666},[771],{"type":48,"value":736},{"type":43,"tag":644,"props":773,"children":774},{"style":666},[775],{"type":48,"value":674},{"type":43,"tag":644,"props":777,"children":778},{"style":666},[779],{"type":48,"value":679},{"type":43,"tag":644,"props":781,"children":782},{"style":666},[783],{"type":48,"value":784}," --wait\n",{"type":43,"tag":644,"props":786,"children":788},{"class":646,"line":787},7,[789,793,797,802,807,811,815,819],{"type":43,"tag":644,"props":790,"children":791},{"style":661},[792],{"type":48,"value":712},{"type":43,"tag":644,"props":794,"children":795},{"style":666},[796],{"type":48,"value":669},{"type":43,"tag":644,"props":798,"children":799},{"style":666},[800],{"type":48,"value":801}," istio-cni",{"type":43,"tag":644,"props":803,"children":804},{"style":666},[805],{"type":48,"value":806}," istio\u002Fcni",{"type":43,"tag":644,"props":808,"children":809},{"style":666},[810],{"type":48,"value":731},{"type":43,"tag":644,"props":812,"children":813},{"style":666},[814],{"type":48,"value":736},{"type":43,"tag":644,"props":816,"children":817},{"style":666},[818],{"type":48,"value":674},{"type":43,"tag":644,"props":820,"children":821},{"style":666},[822],{"type":48,"value":823}," profile=ambient\n",{"type":43,"tag":644,"props":825,"children":827},{"class":646,"line":826},8,[828,832,836,841,846,850],{"type":43,"tag":644,"props":829,"children":830},{"style":661},[831],{"type":48,"value":712},{"type":43,"tag":644,"props":833,"children":834},{"style":666},[835],{"type":48,"value":669},{"type":43,"tag":644,"props":837,"children":838},{"style":666},[839],{"type":48,"value":840}," ztunnel",{"type":43,"tag":644,"props":842,"children":843},{"style":666},[844],{"type":48,"value":845}," istio\u002Fztunnel",{"type":43,"tag":644,"props":847,"children":848},{"style":666},[849],{"type":48,"value":731},{"type":43,"tag":644,"props":851,"children":852},{"style":666},[853],{"type":48,"value":854}," istio-system\n",{"type":43,"tag":644,"props":856,"children":858},{"class":646,"line":857},9,[859],{"type":43,"tag":644,"props":860,"children":861},{"emptyLinePlaceholder":691},[862],{"type":48,"value":694},{"type":43,"tag":644,"props":864,"children":866},{"class":646,"line":865},10,[867],{"type":43,"tag":644,"props":868,"children":869},{"style":651},[870],{"type":48,"value":871},"# Enroll a namespace into the ambient mesh (no pod restart needed)\n",{"type":43,"tag":644,"props":873,"children":875},{"class":646,"line":874},11,[876,881,886,891,896],{"type":43,"tag":644,"props":877,"children":878},{"style":661},[879],{"type":48,"value":880},"kubectl",{"type":43,"tag":644,"props":882,"children":883},{"style":666},[884],{"type":48,"value":885}," label",{"type":43,"tag":644,"props":887,"children":888},{"style":666},[889],{"type":48,"value":890}," namespace",{"type":43,"tag":644,"props":892,"children":893},{"style":666},[894],{"type":48,"value":895}," my-app",{"type":43,"tag":644,"props":897,"children":898},{"style":666},[899],{"type":48,"value":900}," istio.io\u002Fdataplane-mode=ambient\n",{"type":43,"tag":644,"props":902,"children":904},{"class":646,"line":903},12,[905],{"type":43,"tag":644,"props":906,"children":907},{"emptyLinePlaceholder":691},[908],{"type":48,"value":694},{"type":43,"tag":644,"props":910,"children":912},{"class":646,"line":911},13,[913],{"type":43,"tag":644,"props":914,"children":915},{"style":651},[916],{"type":48,"value":917},"# Enroll a namespace for sidecar injection (requires pod restart)\n",{"type":43,"tag":644,"props":919,"children":920},{"class":646,"line":26},[921,925,929,933,937],{"type":43,"tag":644,"props":922,"children":923},{"style":661},[924],{"type":48,"value":880},{"type":43,"tag":644,"props":926,"children":927},{"style":666},[928],{"type":48,"value":885},{"type":43,"tag":644,"props":930,"children":931},{"style":666},[932],{"type":48,"value":890},{"type":43,"tag":644,"props":934,"children":935},{"style":666},[936],{"type":48,"value":895},{"type":43,"tag":644,"props":938,"children":939},{"style":666},[940],{"type":48,"value":941}," istio-injection=enabled\n",{"type":43,"tag":644,"props":943,"children":944},{"class":646,"line":30},[945],{"type":43,"tag":644,"props":946,"children":947},{"emptyLinePlaceholder":691},[948],{"type":48,"value":694},{"type":43,"tag":644,"props":950,"children":952},{"class":646,"line":951},16,[953],{"type":43,"tag":644,"props":954,"children":955},{"style":651},[956],{"type":48,"value":957},"# Enforce strict mTLS mesh-wide\n",{"type":43,"tag":644,"props":959,"children":961},{"class":646,"line":960},17,[962,966,971,976,981,987],{"type":43,"tag":644,"props":963,"children":964},{"style":661},[965],{"type":48,"value":880},{"type":43,"tag":644,"props":967,"children":968},{"style":666},[969],{"type":48,"value":970}," apply",{"type":43,"tag":644,"props":972,"children":973},{"style":666},[974],{"type":48,"value":975}," -f",{"type":43,"tag":644,"props":977,"children":978},{"style":666},[979],{"type":48,"value":980}," -",{"type":43,"tag":644,"props":982,"children":984},{"style":983},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[985],{"type":48,"value":986}," \u003C\u003C",{"type":43,"tag":644,"props":988,"children":989},{"style":983},[990],{"type":48,"value":991},"'EOF'\n",{"type":43,"tag":644,"props":993,"children":995},{"class":646,"line":994},18,[996],{"type":43,"tag":644,"props":997,"children":998},{"style":666},[999],{"type":48,"value":1000},"apiVersion: security.istio.io\u002Fv1\n",{"type":43,"tag":644,"props":1002,"children":1004},{"class":646,"line":1003},19,[1005],{"type":43,"tag":644,"props":1006,"children":1007},{"style":666},[1008],{"type":48,"value":1009},"kind: PeerAuthentication\n",{"type":43,"tag":644,"props":1011,"children":1013},{"class":646,"line":1012},20,[1014],{"type":43,"tag":644,"props":1015,"children":1016},{"style":666},[1017],{"type":48,"value":1018},"metadata: { name: default, namespace: istio-system }\n",{"type":43,"tag":644,"props":1020,"children":1022},{"class":646,"line":1021},21,[1023],{"type":43,"tag":644,"props":1024,"children":1025},{"style":666},[1026],{"type":48,"value":1027},"spec: { mtls: { mode: STRICT } }\n",{"type":43,"tag":644,"props":1029,"children":1031},{"class":646,"line":1030},22,[1032],{"type":43,"tag":644,"props":1033,"children":1034},{"style":983},[1035],{"type":48,"value":1036},"EOF\n",{"type":43,"tag":644,"props":1038,"children":1040},{"class":646,"line":1039},23,[1041],{"type":43,"tag":644,"props":1042,"children":1043},{"emptyLinePlaceholder":691},[1044],{"type":48,"value":694},{"type":43,"tag":644,"props":1046,"children":1048},{"class":646,"line":1047},24,[1049],{"type":43,"tag":644,"props":1050,"children":1051},{"style":651},[1052],{"type":48,"value":1053},"# Inspect proxy\u002Fmesh config and verify mTLS\n",{"type":43,"tag":644,"props":1055,"children":1057},{"class":646,"line":1056},25,[1058,1062],{"type":43,"tag":644,"props":1059,"children":1060},{"style":661},[1061],{"type":48,"value":327},{"type":43,"tag":644,"props":1063,"children":1064},{"style":666},[1065],{"type":48,"value":1066}," proxy-status\n",{"type":43,"tag":644,"props":1068,"children":1070},{"class":646,"line":1069},26,[1071,1075,1080,1084],{"type":43,"tag":644,"props":1072,"children":1073},{"style":661},[1074],{"type":48,"value":327},{"type":43,"tag":644,"props":1076,"children":1077},{"style":666},[1078],{"type":48,"value":1079}," analyze",{"type":43,"tag":644,"props":1081,"children":1082},{"style":666},[1083],{"type":48,"value":731},{"type":43,"tag":644,"props":1085,"children":1086},{"style":666},[1087],{"type":48,"value":1088}," my-app\n",{"type":43,"tag":644,"props":1090,"children":1092},{"class":646,"line":1091},27,[1093,1097,1102,1107],{"type":43,"tag":644,"props":1094,"children":1095},{"style":661},[1096],{"type":48,"value":880},{"type":43,"tag":644,"props":1098,"children":1099},{"style":666},[1100],{"type":48,"value":1101}," get",{"type":43,"tag":644,"props":1103,"children":1104},{"style":666},[1105],{"type":48,"value":1106}," peerauthentication,authorizationpolicy",{"type":43,"tag":644,"props":1108,"children":1109},{"style":666},[1110],{"type":48,"value":1111}," -A\n",{"type":43,"tag":644,"props":1113,"children":1115},{"class":646,"line":1114},28,[1116],{"type":43,"tag":644,"props":1117,"children":1118},{"emptyLinePlaceholder":691},[1119],{"type":48,"value":694},{"type":43,"tag":644,"props":1121,"children":1123},{"class":646,"line":1122},29,[1124],{"type":43,"tag":644,"props":1125,"children":1126},{"style":651},[1127],{"type":48,"value":1128},"# Deploy a waypoint proxy for L7 features in an ambient namespace\n",{"type":43,"tag":644,"props":1130,"children":1132},{"class":646,"line":1131},30,[1133,1137,1142,1146,1150,1154],{"type":43,"tag":644,"props":1134,"children":1135},{"style":661},[1136],{"type":48,"value":327},{"type":43,"tag":644,"props":1138,"children":1139},{"style":666},[1140],{"type":48,"value":1141}," waypoint",{"type":43,"tag":644,"props":1143,"children":1144},{"style":666},[1145],{"type":48,"value":970},{"type":43,"tag":644,"props":1147,"children":1148},{"style":666},[1149],{"type":48,"value":731},{"type":43,"tag":644,"props":1151,"children":1152},{"style":666},[1153],{"type":48,"value":895},{"type":43,"tag":644,"props":1155,"children":1156},{"style":666},[1157],{"type":48,"value":1158}," --enroll-namespace\n",{"type":43,"tag":51,"props":1160,"children":1162},{"id":1161},"output-format",[1163],{"type":48,"value":1164},"Output Format",{"type":43,"tag":1166,"props":1167,"children":1168},"table",{},[1169,1188],{"type":43,"tag":1170,"props":1171,"children":1172},"thead",{},[1173],{"type":43,"tag":1174,"props":1175,"children":1176},"tr",{},[1177,1183],{"type":43,"tag":1178,"props":1179,"children":1180},"th",{},[1181],{"type":48,"value":1182},"Field",{"type":43,"tag":1178,"props":1184,"children":1185},{},[1186],{"type":48,"value":1187},"Details",{"type":43,"tag":1189,"props":1190,"children":1191},"tbody",{},[1192,1209,1225,1241,1257,1273,1289,1305,1321],{"type":43,"tag":1174,"props":1193,"children":1194},{},[1195,1204],{"type":43,"tag":1196,"props":1197,"children":1198},"td",{},[1199],{"type":43,"tag":73,"props":1200,"children":1201},{},[1202],{"type":48,"value":1203},"Mesh decision",{"type":43,"tag":1196,"props":1205,"children":1206},{},[1207],{"type":48,"value":1208},"Why a mesh is (or isn't) justified for this workload",{"type":43,"tag":1174,"props":1210,"children":1211},{},[1212,1220],{"type":43,"tag":1196,"props":1213,"children":1214},{},[1215],{"type":43,"tag":73,"props":1216,"children":1217},{},[1218],{"type":48,"value":1219},"Data plane mode",{"type":43,"tag":1196,"props":1221,"children":1222},{},[1223],{"type":48,"value":1224},"Ambient (default) or sidecar, with rationale",{"type":43,"tag":1174,"props":1226,"children":1227},{},[1228,1236],{"type":43,"tag":1196,"props":1229,"children":1230},{},[1231],{"type":43,"tag":73,"props":1232,"children":1233},{},[1234],{"type":48,"value":1235},"Istio version",{"type":43,"tag":1196,"props":1237,"children":1238},{},[1239],{"type":48,"value":1240},"Version pinned, verified against the EKS Kubernetes version",{"type":43,"tag":1174,"props":1242,"children":1243},{},[1244,1252],{"type":43,"tag":1196,"props":1245,"children":1246},{},[1247],{"type":43,"tag":73,"props":1248,"children":1249},{},[1250],{"type":48,"value":1251},"Install method",{"type":43,"tag":1196,"props":1253,"children":1254},{},[1255],{"type":48,"value":1256},"Helm or istioctl; upstream vs partner-managed; GitOps tooling",{"type":43,"tag":1174,"props":1258,"children":1259},{},[1260,1268],{"type":43,"tag":1196,"props":1261,"children":1262},{},[1263],{"type":43,"tag":73,"props":1264,"children":1265},{},[1266],{"type":48,"value":1267},"mTLS posture",{"type":43,"tag":1196,"props":1269,"children":1270},{},[1271],{"type":48,"value":1272},"PeerAuthentication mode and any exemptions",{"type":43,"tag":1174,"props":1274,"children":1275},{},[1276,1284],{"type":43,"tag":1196,"props":1277,"children":1278},{},[1279],{"type":43,"tag":73,"props":1280,"children":1281},{},[1282],{"type":48,"value":1283},"Authorization",{"type":43,"tag":1196,"props":1285,"children":1286},{},[1287],{"type":48,"value":1288},"Default-deny + explicit allow policies per service",{"type":43,"tag":1174,"props":1290,"children":1291},{},[1292,1300],{"type":43,"tag":1196,"props":1293,"children":1294},{},[1295],{"type":43,"tag":73,"props":1296,"children":1297},{},[1298],{"type":48,"value":1299},"Traffic management",{"type":43,"tag":1196,"props":1301,"children":1302},{},[1303],{"type":48,"value":1304},"VirtualService\u002FDestinationRule strategy (canary, blue\u002Fgreen, mirroring)",{"type":43,"tag":1174,"props":1306,"children":1307},{},[1308,1316],{"type":43,"tag":1196,"props":1309,"children":1310},{},[1311],{"type":43,"tag":73,"props":1312,"children":1313},{},[1314],{"type":48,"value":1315},"Ingress split",{"type":43,"tag":1196,"props":1317,"children":1318},{},[1319],{"type":48,"value":1320},"ALB Controller for north-south; Istio gateway \u002F Gateway API for L7 edge",{"type":43,"tag":1174,"props":1322,"children":1323},{},[1324,1331],{"type":43,"tag":1196,"props":1325,"children":1326},{},[1327],{"type":43,"tag":73,"props":1328,"children":1329},{},[1330],{"type":48,"value":586},{"type":43,"tag":1196,"props":1332,"children":1333},{},[1334],{"type":48,"value":1335},"Kiali, tracing backend, metrics (AMP\u002FAMG or Prometheus\u002FGrafana)",{"type":43,"tag":51,"props":1337,"children":1339},{"id":1338},"related-skills",[1340],{"type":48,"value":1341},"Related Skills",{"type":43,"tag":151,"props":1343,"children":1344},{},[1345,1356,1366,1376,1387],{"type":43,"tag":62,"props":1346,"children":1347},{},[1348,1354],{"type":43,"tag":108,"props":1349,"children":1351},{"className":1350},[],[1352],{"type":48,"value":1353},"eks",{"type":48,"value":1355}," — Cluster lifecycle, compute, add-ons, and autoscaling the mesh runs on",{"type":43,"tag":62,"props":1357,"children":1358},{},[1359,1364],{"type":43,"tag":108,"props":1360,"children":1362},{"className":1361},[],[1363],{"type":48,"value":15},{"type":48,"value":1365}," — VPC design, VPC CNI, and NetworkPolicy that complements mesh authz",{"type":43,"tag":62,"props":1367,"children":1368},{},[1369,1374],{"type":43,"tag":108,"props":1370,"children":1372},{"className":1371},[],[1373],{"type":48,"value":583},{"type":48,"value":1375}," — CloudWatch Container Insights, Amazon Managed Prometheus\u002FGrafana, tracing",{"type":43,"tag":62,"props":1377,"children":1378},{},[1379,1385],{"type":43,"tag":108,"props":1380,"children":1382},{"className":1381},[],[1383],{"type":48,"value":1384},"iam",{"type":48,"value":1386}," — Pod Identity \u002F IRSA for mesh components needing AWS permissions",{"type":43,"tag":62,"props":1388,"children":1389},{},[1390,1396],{"type":43,"tag":108,"props":1391,"children":1393},{"className":1392},[],[1394],{"type":48,"value":1395},"ecs",{"type":48,"value":1397}," — For ECS workloads, use ECS Service Connect instead of a Kubernetes mesh",{"type":43,"tag":51,"props":1399,"children":1401},{"id":1400},"anti-patterns",[1402],{"type":48,"value":1403},"Anti-Patterns",{"type":43,"tag":151,"props":1405,"children":1406},{},[1407,1417,1434,1444,1454,1471,1481,1498],{"type":43,"tag":62,"props":1408,"children":1409},{},[1410,1415],{"type":43,"tag":73,"props":1411,"children":1412},{},[1413],{"type":48,"value":1414},"Adopting a mesh too early",{"type":48,"value":1416},": a few services and one team do not need a mesh. Use NetworkPolicy + ALB Controller first; add a mesh when mTLS, fine-grained traffic shifting, or platform-level authz becomes a real requirement.",{"type":43,"tag":62,"props":1418,"children":1419},{},[1420,1425,1427,1432],{"type":43,"tag":73,"props":1421,"children":1422},{},[1423],{"type":48,"value":1424},"Choosing AWS App Mesh for new work",{"type":48,"value":1426},": App Mesh reaches ",{"type":43,"tag":73,"props":1428,"children":1429},{},[1430],{"type":48,"value":1431},"end of support on September 30, 2026",{"type":48,"value":1433},". Do not build new meshes on it. For EKS use Istio; for ECS use ECS Service Connect.",{"type":43,"tag":62,"props":1435,"children":1436},{},[1437,1442],{"type":43,"tag":73,"props":1438,"children":1439},{},[1440],{"type":48,"value":1441},"Defaulting to sidecars on a greenfield mesh",{"type":48,"value":1443},": ambient mode (GA in 1.24) cuts proxy overhead dramatically and avoids injection pitfalls. Prefer ambient unless a specific feature requires sidecars.",{"type":43,"tag":62,"props":1445,"children":1446},{},[1447,1452],{"type":43,"tag":73,"props":1448,"children":1449},{},[1450],{"type":48,"value":1451},"Leaving mTLS in PERMISSIVE forever",{"type":48,"value":1453},": PERMISSIVE is a migration state, not a destination. Move to STRICT once all traffic is mTLS, or you gain proxies without the zero-trust benefit.",{"type":43,"tag":62,"props":1455,"children":1456},{},[1457,1462,1464,1469],{"type":43,"tag":73,"props":1458,"children":1459},{},[1460],{"type":48,"value":1461},"No default-deny authorization",{"type":48,"value":1463},": without a default-deny ",{"type":43,"tag":108,"props":1465,"children":1467},{"className":1466},[],[1468],{"type":48,"value":455},{"type":48,"value":1470},", any meshed service can call any other. Start denied, then allow explicitly.",{"type":43,"tag":62,"props":1472,"children":1473},{},[1474,1479],{"type":43,"tag":73,"props":1475,"children":1476},{},[1477],{"type":48,"value":1478},"Duplicating ingress",{"type":48,"value":1480},": running the Istio ingress gateway and the ALB Controller for the same north-south path adds a hop and cost. Let the ALB Controller own the edge; let the mesh own east-west.",{"type":43,"tag":62,"props":1482,"children":1483},{},[1484,1489,1491,1496],{"type":43,"tag":73,"props":1485,"children":1486},{},[1487],{"type":48,"value":1488},"Unpinned, click-ops installs",{"type":48,"value":1490},": ad hoc ",{"type":43,"tag":108,"props":1492,"children":1494},{"className":1493},[],[1495],{"type":48,"value":335},{"type":48,"value":1497}," of Istio drifts and breaks upgrades. Pin versions and manage via Helm + GitOps; upgrade one minor version at a time and test in non-prod.",{"type":43,"tag":62,"props":1499,"children":1500},{},[1501,1506,1507,1512],{"type":43,"tag":73,"props":1502,"children":1503},{},[1504],{"type":48,"value":1505},"Ignoring the mesh as a failure domain",{"type":48,"value":488},{"type":43,"tag":108,"props":1508,"children":1510},{"className":1509},[],[1511],{"type":48,"value":304},{"type":48,"value":1513},", gateways, and ztunnel are now in your request path. Give them PDBs, multi-AZ spread, resource requests\u002Flimits, and upgrade runbooks.",{"type":43,"tag":1515,"props":1516,"children":1517},"style",{},[1518],{"type":48,"value":1519},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1521,"total":1697},[1522,1539,1560,1570,1583,1596,1606,1616,1637,1652,1667,1682],{"slug":1523,"name":1523,"fn":1524,"description":1525,"org":1526,"tags":1527,"stars":1536,"repoUrl":1537,"updatedAt":1538},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1528,1529,1532,1535],{"name":24,"slug":25,"type":16},{"name":1530,"slug":1531,"type":16},"Debugging","debugging",{"name":1533,"slug":1534,"type":16},"Logs","logs",{"name":586,"slug":583,"type":16},9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",{"slug":1540,"name":1541,"fn":1542,"description":1543,"org":1544,"tags":1545,"stars":1536,"repoUrl":1537,"updatedAt":1559},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1546,1549,1550,1553,1556],{"name":1547,"slug":1548,"type":16},"Aurora","aurora",{"name":24,"slug":25,"type":16},{"name":1551,"slug":1552,"type":16},"Database","database",{"name":1554,"slug":1555,"type":16},"Serverless","serverless",{"name":1557,"slug":1558,"type":16},"SQL","sql","2026-07-12T08:36:45.053393",{"slug":1561,"name":1562,"fn":1542,"description":1543,"org":1563,"tags":1564,"stars":1536,"repoUrl":1537,"updatedAt":1569},"aurora-dsql","aurora dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1565,1566,1567,1568],{"name":24,"slug":25,"type":16},{"name":1551,"slug":1552,"type":16},{"name":1554,"slug":1555,"type":16},{"name":1557,"slug":1558,"type":16},"2026-07-12T08:36:42.694299",{"slug":1571,"name":1572,"fn":1542,"description":1543,"org":1573,"tags":1574,"stars":1536,"repoUrl":1537,"updatedAt":1582},"aws-dsql","aws dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1575,1576,1577,1580,1581],{"name":24,"slug":25,"type":16},{"name":1551,"slug":1552,"type":16},{"name":1578,"slug":1579,"type":16},"Migration","migration",{"name":1554,"slug":1555,"type":16},{"name":1557,"slug":1558,"type":16},"2026-07-12T08:36:38.584057",{"slug":1584,"name":1585,"fn":1542,"description":1543,"org":1586,"tags":1587,"stars":1536,"repoUrl":1537,"updatedAt":1595},"distributed-postgres","distributed postgres",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1588,1589,1590,1593,1594],{"name":24,"slug":25,"type":16},{"name":1551,"slug":1552,"type":16},{"name":1591,"slug":1592,"type":16},"PostgreSQL","postgresql",{"name":1554,"slug":1555,"type":16},{"name":1557,"slug":1558,"type":16},"2026-07-12T08:36:46.530743",{"slug":1597,"name":1598,"fn":1542,"description":1543,"org":1599,"tags":1600,"stars":1536,"repoUrl":1537,"updatedAt":1605},"distributed-sql","distributed sql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1601,1602,1603,1604],{"name":24,"slug":25,"type":16},{"name":1551,"slug":1552,"type":16},{"name":1554,"slug":1555,"type":16},{"name":1557,"slug":1558,"type":16},"2026-07-12T08:36:48.104182",{"slug":1607,"name":1607,"fn":1542,"description":1543,"org":1608,"tags":1609,"stars":1536,"repoUrl":1537,"updatedAt":1615},"dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1610,1611,1612,1613,1614],{"name":24,"slug":25,"type":16},{"name":1551,"slug":1552,"type":16},{"name":1578,"slug":1579,"type":16},{"name":1554,"slug":1555,"type":16},{"name":1557,"slug":1558,"type":16},"2026-07-12T08:36:36.374512",{"slug":1617,"name":1617,"fn":1618,"description":1619,"org":1620,"tags":1621,"stars":1634,"repoUrl":1635,"updatedAt":1636},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1622,1625,1628,1631],{"name":1623,"slug":1624,"type":16},"Accounting","accounting",{"name":1626,"slug":1627,"type":16},"Analytics","analytics",{"name":1629,"slug":1630,"type":16},"Cost Optimization","cost-optimization",{"name":1632,"slug":1633,"type":16},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":1638,"name":1638,"fn":1639,"description":1640,"org":1641,"tags":1642,"stars":1634,"repoUrl":1635,"updatedAt":1651},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1643,1644,1645,1648],{"name":24,"slug":25,"type":16},{"name":1632,"slug":1633,"type":16},{"name":1646,"slug":1647,"type":16},"Management","management",{"name":1649,"slug":1650,"type":16},"Reporting","reporting","2026-07-12T08:40:02.066471",{"slug":1653,"name":1653,"fn":1654,"description":1655,"org":1656,"tags":1657,"stars":1634,"repoUrl":1635,"updatedAt":1666},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1658,1659,1660,1663],{"name":1626,"slug":1627,"type":16},{"name":1632,"slug":1633,"type":16},{"name":1661,"slug":1662,"type":16},"Financial Statements","financial-statements",{"name":1664,"slug":1665,"type":16},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":1668,"name":1668,"fn":1669,"description":1670,"org":1671,"tags":1672,"stars":1634,"repoUrl":1635,"updatedAt":1681},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1673,1676,1679],{"name":1674,"slug":1675,"type":16},"Automation","automation",{"name":1677,"slug":1678,"type":16},"Documents","documents",{"name":1680,"slug":1668,"type":16},"PDF","2026-07-12T08:41:44.135656",{"slug":1683,"name":1683,"fn":1684,"description":1685,"org":1686,"tags":1687,"stars":1634,"repoUrl":1635,"updatedAt":1696},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1688,1689,1692,1693],{"name":1623,"slug":1624,"type":16},{"name":1690,"slug":1691,"type":16},"Data Analysis","data-analysis",{"name":1632,"slug":1633,"type":16},{"name":1694,"slug":1695,"type":16},"KPI","kpi","2026-07-12T08:39:59.54971",150,{"items":1699,"total":1792},[1700,1714,1727,1739,1751,1764,1777],{"slug":1701,"name":1701,"fn":1702,"description":1703,"org":1704,"tags":1705,"stars":26,"repoUrl":27,"updatedAt":1713},"agentcore","design Amazon Bedrock AgentCore architectures","Deep-dive into Amazon Bedrock AgentCore platform design, service selection, deployment, and production operations. This skill should be used when the user asks to \"design an AgentCore architecture\", \"deploy agents on AgentCore\", \"configure AgentCore Runtime\", \"set up AgentCore Memory\", \"use AgentCore Gateway\", \"configure AgentCore Identity\", \"set up AgentCore Policy\", \"plan agent observability\", \"evaluate agent quality\", \"move agent PoC to production\", or mentions AgentCore, AgentCore Runtime, AgentCore Memory, AgentCore Gateway, AgentCore Identity, AgentCore Policy, AgentCore Evaluations, AgentCore Code Interpreter, AgentCore Browser, A2A protocol, or multi-agent orchestration on AWS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1706,1709,1712],{"name":1707,"slug":1708,"type":16},"Agents","agents",{"name":1710,"slug":1711,"type":16},"Architecture","architecture",{"name":24,"slug":25,"type":16},"2026-07-12T08:40:11.108951",{"slug":1715,"name":1715,"fn":1716,"description":1717,"org":1718,"tags":1719,"stars":26,"repoUrl":27,"updatedAt":1726},"aidlc-lite","develop AI applications on AWS","Lightweight AI development lifecycle for building on AWS. A simplified take on the AI-DLC philosophy — think together, then build fast. Acts as a design partner that understands intent, proposes alternatives with trade-offs, and ships working code without the ceremony of full requirements\u002Fdesign\u002Fspec documents. Use when a founder says \"build X on AWS\", \"add Y to my stack\", \"scaffold an API\", or \"write the CDK for Z\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1720,1721,1724,1725],{"name":1707,"slug":1708,"type":16},{"name":1722,"slug":1723,"type":16},"AI Infrastructure","ai-infrastructure",{"name":24,"slug":25,"type":16},{"name":18,"slug":19,"type":16},"2026-07-12T08:40:40.204103",{"slug":1728,"name":1728,"fn":1729,"description":1730,"org":1731,"tags":1732,"stars":26,"repoUrl":27,"updatedAt":1738},"architect-for-startups","advise on AWS architecture for startups","AWS architecture advisor tailored specifically for startups. Alters AWS architecture recommendations based on startup stage (pre-revenue through Series B+), team size, runway, and credits. ALWAYS use when asked about building on AWS, choosing services, planning infrastructure, managing costs with credits, or preparing architecture for fundraising.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1733,1734,1735],{"name":1710,"slug":1711,"type":16},{"name":24,"slug":25,"type":16},{"name":1736,"slug":1737,"type":16},"Strategy","strategy","2026-07-12T08:41:33.557354",{"slug":1740,"name":1740,"fn":1741,"description":1742,"org":1743,"tags":1744,"stars":26,"repoUrl":27,"updatedAt":1750},"aws-architect","design and review AWS architectures","Design and review AWS architectures following Well-Architected Framework principles. Use when planning new infrastructure, reviewing existing architectures, evaluating trade-offs between AWS services, or when asked about AWS best practices.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1745,1746,1747],{"name":1710,"slug":1711,"type":16},{"name":24,"slug":25,"type":16},{"name":1748,"slug":1749,"type":16},"Infrastructure","infrastructure","2026-07-12T08:40:57.630086",{"slug":1752,"name":1752,"fn":1753,"description":1754,"org":1755,"tags":1756,"stars":26,"repoUrl":27,"updatedAt":1763},"aws-compare","compare AWS architecture options","Compare 2-3 AWS architecture options side-by-side across cost, complexity, performance, security, and operational burden. Use when evaluating trade-offs between approaches or when the user is deciding between options.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1757,1758,1759,1760],{"name":1710,"slug":1711,"type":16},{"name":24,"slug":25,"type":16},{"name":1629,"slug":1630,"type":16},{"name":1761,"slug":1762,"type":16},"Security","security","2026-07-12T08:40:23.960287",{"slug":1765,"name":1765,"fn":1766,"description":1767,"org":1768,"tags":1769,"stars":26,"repoUrl":27,"updatedAt":1776},"aws-debug","debug AWS infrastructure and deployment failures","Debug AWS infrastructure issues, deployment failures, and runtime errors. Use when troubleshooting CloudFormation stack failures, Lambda errors, ECS task failures, permission issues, networking problems, or any AWS service misbehavior.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1770,1771,1772,1775],{"name":24,"slug":25,"type":16},{"name":1530,"slug":1531,"type":16},{"name":1773,"slug":1774,"type":16},"Deployment","deployment",{"name":586,"slug":583,"type":16},"2026-07-12T08:40:16.767171",{"slug":1778,"name":1778,"fn":1779,"description":1780,"org":1781,"tags":1782,"stars":26,"repoUrl":27,"updatedAt":1791},"aws-diagram","generate AWS architecture diagrams","Generate AWS architecture diagrams in Mermaid or ASCII from a description, existing IaC, or conversation context. Use when the user wants to visualize an architecture.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1783,1784,1785,1788],{"name":1710,"slug":1711,"type":16},{"name":24,"slug":25,"type":16},{"name":1786,"slug":1787,"type":16},"Diagrams","diagrams",{"name":1789,"slug":1790,"type":16},"Visualization","visualization","2026-07-12T08:40:43.26341",42]