AWS Outposts

What it is

AWS Outposts is a fully managed service that puts AWS infrastructure in your own data center or other on-premisesOn-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entryClose location. AWS delivers, installs, monitors, and maintains the hardware; you use the same APIsAPI (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entryClose, console, and tools as in an AWS RegionAWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entryClose to run EC2 instances, EBS volumes, containers, and some databases on it.

An Outpost is an extension of an Availability ZoneAZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entryClose in its parent Region. You create subnetsSubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entryClose on the Outpost in your VPC, and resources there talk to resources in the Region over private IPIP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entryClose addresses.

Choose Outposts when workloads must run on premises, close to local systems, because of:

• Low latencyLatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entryClose to on-premises applications or equipment, such as factory machines or trading systems.
• Local data processing, where data is too large or too sensitive to send to a Region first.
• Data residency, where data must stay in a particular site or country.

Form factors

	Outposts racks	Outposts servers
Size	Industry-standard 42U racks, scaling to many racks	1U or 2U servers for a standard rack
For	Data centers that need large capacity and the broadest set of services	Sites with little space or smaller needs, such as retail stores, branch offices, or factories
Services	EC2, EBS, S3 on Outposts, ECS, EKS, RDS, ElastiCache, EMR, Application Load Balancer, Route 53 Resolver	EC2, ECS, and VPC subnets; no EBS or S3
Installation	By AWS	By you

Networking

• The service link is the encrypted connection (a set of VPNVPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entryClose connections) from the Outpost to its parent Region. It carries management traffic and your VPC traffic to the Region, over AWS Direct Connect or the internet. AWS requires redundant connectivity of at least 500 Mbps per compute rack, with no more than 175 ms round-trip latency.
• The local gateway connects an Outposts rack's subnets to your on-premises network, so local users and systems reach Outpost resources directly. Outposts servers use a local network interface for the same purpose.

When the service link is down

Outposts are not designed for disconnected operation:

• Running EC2 instances and their attached EBS volumes keep running and stay reachable locally through the local gateway.
• The control plane is unavailable: you cannot launch, start, stop, or terminate instances until the link is back.
• Metrics and logs are cached locally for up to 7 days and sent when the link returns.

So design the service link to be highly availableHA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entryClose, and test how your workload behaves without it.

Security, resilience, performance, and cost

Security

• Data on an Outpost is protected by a physical Nitro Security Key. AWS removes it before hardware leaves your site, which cryptographically destroys the data.
• S3 on Outposts stores data locally, and IAM policies can stop people copying EBS local snapshots or images out of the Outpost, which supports data residency.
• Physical security is your responsibility: the hardware is at your site, so you control access to it.
• IAM, security groupsSecurity groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entryClose, and the rest of the AWS security model work as in a Region.

Resilience

• An Outpost is a single site: it is not spread across Availability Zones the way a Region is. For high availability, deploy several Outposts, each attached to a different Availability Zone, and run the application across them.
• Order spare capacity (N+1 for each instance family) so instances can recover on another host if one fails.
• Use a spread placement group to put instances on distinct racks, and EC2 Auto Scaling with an Application Load Balancer within the Outpost.
• Back up data to the Region, and provide dual power and redundant network connections at the site.

Performance

• Applications on the Outpost get local, low-latency access to on-premises systems.
• Capacity is fixed to what you ordered: Auto Scaling cannot add hosts beyond the Outpost's capacity. Plan capacity in advance and monitor it with CloudWatch capacity metrics.

Cost

• Outposts racks are bought for a 3-year term, with All Upfront, Partial Upfront, or No Upfront payment. The price covers EC2 capacity, EBS, and S3 on Outposts, plus delivery, installation, maintenance, and patching.
• You pay for the capacity whether or not you use it, so size it carefully. Data transfer between the Outpost and its parent Region is free.
• Ordering Outposts requires AWS Enterprise Support.

Monitoring

• Amazon CloudWatch shows Outpost capacity and utilization metrics; alarm on them to avoid running out of capacity.
• AWS CloudTrail records API calls made to manage the Outpost and its resources.

Outposts, Local Zones, or Wavelength?

	AWS Outposts	AWS Local Zones	AWS Wavelength
Where	Your own site	AWS-run locations near large cities and industry centers	Inside telecom providers' 5G networks
Choose for	Workloads that must stay on premises: local systems, local processing, data residency	Low latency to users in a metro area, without your own data center	Lowest latency to mobile and connected devices on a 5G network
You provide	Space, power, network, and physical security	Nothing extra	Nothing extra

Reverse mindmap: when the question points here

• Yes, when the question says
  • Run AWS services in our own data center→ leads to AWS Outposts
  • Data must stay on premises for residency→ leads to Outposts with S3 on Outposts
  • Lowest latency to on-premises systems→ leads to Outposts rack
  • Small retail or factory site needs local compute→ leads to Outposts server
• Design it
  • Connect the Outpost to its Region→ leads to Service link over Direct Connect
  • Reach Outpost instances from the local network→ leads to Local gateway
  • Survive the loss of one Outpost→ leads to Several Outposts on different Availability Zones
  • Instances on separate racks→ leads to Spread placement group
• No, when the question says
  • Low latency to city users, no data center of our own→ leads to AWS Local Zones
  • Low latency to 5G mobile devices→ leads to AWS Wavelength
  • Move a VMware environment unchanged→ leads to VMware Cloud on AWS or Amazon EVS

Key takeaways

• Outposts brings AWS infrastructure, services, and APIs to your own site, managed by AWS, as an extension of an Availability Zone.
• Racks give large capacity and the most services; servers suit small sites.
• The service link connects to the Region; the local gateway connects to your on-premises network.
• Running workloads survive a service link outage, but you cannot manage them until it returns.
• Capacity is fixed and bought for 3 years; deploy several Outposts on different Availability Zones for resilience.

Sources

• AWS Outposts User Guide: What is AWS Outposts?
• AWS Outposts User Guide: Connectivity through service link
• AWS Outposts User Guide: Resilience in AWS Outposts
• AWS Outposts rack FAQs
• AWS Outposts rack features
• AWS Outposts rack pricing
• AWS Local Zones User Guide: What is AWS Local Zones?
• AWS Wavelength FAQs