EKS Ingress with VPC Lattice - console guide

VPC Lattice provides application-layer connectivity across VPCs and accounts with auth policies and service networks. On EKS, teams combine Gateway API or Lattice targets with cluster ingress controllers.

Deep labs: VPC Lattice path routing · EKS Lattice Gateway API · dir/vpc-lattic-eks
Checklist: DevOps checklist

Official: What is VPC Lattice?

Use cases

Scenario	Why Lattice
Shared platform cluster, many consumer VPCs	Service network association without VPC peering mesh
Fine-grained auth between services	Lattice auth policy on service
Gradual strangler from monolith	Path-based routing to K8s and EC2 targets
Internal API catalog	DNS names under service network

When ALB alone is enough: single VPC, north-south HTTP only - use ALB Ingress Controller.

Architecture

Consumer VPC (Lambda/ECS) ──► VPC Lattice service network ──► Lattice service ──► EKS (Gateway/HTTPRoute)

Console - service network

VPC Lattice console → Service networks → Create.
Name: platform-internal.
Auth policy (optional): IAM-based access - define who can invoke.

Console - register EKS workload

Paths vary by integration generation; typical flow:

Create service in Lattice linked to target group (IP targets = pod ENIs or NodePort path per design).
Associate service network with consumer VPCs (same or cross-account via RAM).
On EKS: deploy AWS Gateway API Controller for Lattice (updated guide).

EKS console touchpoints

EKS → cluster → verify OIDC provider for IRSA.
Install Lattice/Gateway controller with IAM policy from AWS docs.
Apply Gateway + HTTPRoute manifests pointing to Service.

Configuration details

Item	Note
Health checks	Lattice target health independent of K8s `ready` - align probes
TLS	Terminate at Lattice or pass-through - pick one model
DNS	Lattice-generated names; integrate with private DNS if needed
Security groups	Pod SG must allow Lattice ENI traffic

IAM

Controller role: vpc-lattice:* scoped + elasticloadbalancing if hybrid.
Consumer principals allowed in auth policy on service network association.

Commonly missed

Mixing ALB Ingress annotations with Lattice routes without clear ownership
Forgetting cross-account RAM accept for service network
Target type mismatch (instance vs IP) on Fargate
No auth policy - open internal mesh

Troubleshooting

Symptom	Check
403 from Lattice	Auth policy principal
No healthy targets	Pod labels, `HTTPRoute` backend ref, SG
DNS fails in consumer VPC	Association + resolver rules

← Checklist · Lattice application networking