Emerging AWS Services

TL;DR

• Novelty is not an adoption criterion: a newly-launched service earns a place on a critical path only after clearing the same bar as any established service — regional availability, quota fit, IAM/permission maturity, and a real rollback path.
• VPC Lattice adds an application-layer (service-to-service) networking model with built-in authN/authZ, filling a gap that Transit Gateway (network layer, CIDR/routing) and PrivateLink (single-service endpoint) each only partially cover.
• Verified Access replaces VPN-based network-perimeter trust with per-request identity/device-posture verification (Zero Trust for application access).
• Verified Permissions centralizes authorization policy (Cedar policy language) as an external managed service instead of duplicating authorization logic per application.
• Clean Rooms solves multi-party data collaboration without exposing raw data to either party — a fundamentally different requirement than a data-sharing/export pipeline.
• IPAM’s core capability isn’t new, but it becomes mandatory (not optional) once an organization has more VPCs/accounts than can be tracked manually without CIDR collisions.

Core Concepts

VPC Lattice

Provides application-layer networking: service-to-service communication with authentication and authorization enforced per request, spanning VPC and account boundaries. It removes the need for CIDR planning, route table management, and peering/TGW attachments that Transit Gateway requires for equivalent reachability, and it goes beyond PrivateLink’s single-service-endpoint model by managing a full service network with consistent auth policy across many services. The distinguishing layer: TGW and PrivateLink solve network reachability; VPC Lattice solves service identity and authorization on top of reachability.

Verified Access

Implements Zero Trust for application access: every request is evaluated against identity signals (SSO/IdP) and device posture (managed device, patch status, etc.) rather than trusting anything that already has network-level access (e.g., anyone connected via corporate VPN). It directly replaces the “VPN for internal tools” pattern with per-request, context-aware authorization decisions, removing the assumption that network perimeter equals trust boundary.

Verified Permissions

A managed authorization service built on the Cedar policy language. Applications call out to Verified Permissions to evaluate authorization decisions instead of embedding and duplicating authorization logic in each codebase. This centralizes policy (single source of truth), makes authorization changes auditable, and eliminates policy drift that occurs when each service implements its own ad hoc rules.

DataZone

A data governance and discovery catalog for large, multi-team data estates. It extends beyond Lake Formation’s access-control primitives by adding discovery and business-context metadata — answering “what data exists and who can find it,” not just “who can access this specific table.”

Clean Rooms

Purpose-built for multi-party data collaboration where no party wants to expose raw records to the other. Both parties can run analysis over combined datasets while each side’s underlying data remains hidden from the other. This is architecturally distinct from a data-sharing pipeline (export/import raw data) — Clean Rooms exists specifically for the privacy-preserving collaboration case (e.g., joint marketing analytics between two companies) where raw data exposure is a hard constraint, not a preference.

Cloud WAN

The evolution past single-Region Transit Gateway hub-and-spoke topology. It provides global, policy-based network management for organizations whose connectivity requirements have outgrown a single-hub TGW design — centralized, intent-based network segments and routing policy across Regions instead of per-Region TGW configuration stitched together manually.

IPAM

Centralizes IP address (CIDR) allocation and tracking across accounts and Regions. The underlying capability (central IP registry) is not new, but its necessity scales nonlinearly with organizational size: manual tracking is viable for a handful of VPCs, but becomes unreliable and collision-prone once an organization operates dozens or hundreds of VPCs across multiple accounts. Past that scale, IPAM is foundational infrastructure, not an optional add-on.

VPC Lattice vs Transit Gateway vs PrivateLink

Common Pitfalls

• Pitfall: Adopting a newly-launched service on a customer-facing critical path immediately after announcement. Why: Regional availability, service quotas, and IAM maturity for new services often lag general availability hype. Fix: Validate quota fit, regional presence, and rollback path before critical-path adoption.
• Pitfall: Continuing to rely on VPN-based network trust for internal tool access. Why: Network-perimeter trust assumes anyone inside the VPN is safe, which doesn’t hold once devices or credentials are compromised. Fix: Evaluate Verified Access for per-request, identity/device-aware authorization.
• Pitfall: Authorization logic duplicated and drifting across many application codebases. Why: Each team implements its own rules independently, producing inconsistent and hard-to-audit policy. Fix: Centralize with Verified Permissions (Cedar) as a shared authorization service.
• Pitfall: Manual CIDR tracking past a handful of VPCs. Why: Manual spreadsheets/tribal knowledge don’t scale and produce CIDR collisions across accounts/Regions. Fix: Adopt IPAM once VPC count and account count grow past what one team can track reliably.

Interview Questions

• “A team wants to adopt a service that launched last week for a customer-facing critical path. What do you validate first?” — tests whether the same operational rigor applies to new and established services.
• “Explain when you’d reach for VPC Lattice instead of Transit Gateway or PrivateLink.” — tests understanding of the application-layer vs. network-layer distinction.
• “Two partner companies want joint insights from combined customer data without sharing raw records. Design the solution.” — tests whether Clean Rooms is correctly identified as purpose-built for this exact scenario.
• “Why does IPAM matter more today than with a handful of VPCs, even though the underlying capability isn’t new?” — tests understanding that IPAM’s value scales with organizational complexity.
• “What’s the architectural difference between Verified Permissions and each application implementing its own authorization checks?” — tests understanding of centralized vs. duplicated authorization models.