Hybrid & Edge on AWS (2026): Outposts vs Local Zones vs Wavelength — Placement, Connectivity, and the Latency Bill
Quick summary: A composite fintech API (~8ms p99 to metro users) spent ~$22k/mo on hybrid infrastructure around an Outposts rack before moving read-heavy paths to a Chicago Local Zone and keeping Outposts only for card-PIN HSM proximity. p99 held at 9ms and hybrid infra dropped ~38%. This post covers placement and connectivity, not EC2-vs-Lambda unit economics.
Key Takeaways
- p99 held at 9ms and hybrid infra dropped ~38%
- This post covers placement and connectivity, not EC2-vs-Lambda unit economics
- As of June 2026, AWS offers four distinct placement layers (Regions, Local Zones, Outposts, and Wavelength) plus CloudFront for cacheable edge delivery
- Local Zones put AWS-operated compute in metros; Outposts put AWS-managed hardware on your floor; Wavelength puts compute in carrier 5G facilities
- This post covers where workloads run and how packets move, not EC2 vs Lambda economics
Table of Contents
As of June 2026, AWS offers four distinct placement layers (Regions, Local Zones, Outposts, and Wavelength) plus CloudFront for cacheable edge delivery. The expensive mistake is treating them as interchangeable “edge” checkboxes. Local Zones put AWS-operated compute in metros; Outposts put AWS-managed hardware on your floor; Wavelength puts compute in carrier 5G facilities. Pick wrong and you buy a rack when a subnet would do.
This post covers where workloads run and how packets move, not EC2 vs Lambda economics. That hybrid-compute guide covers invocation patterns and SQS buffering; this one covers metro latency, residency, Direct Connect, and the service link.
We ship a placement decision matrix, hybrid connectivity checklist, latency vs cost worksheet, and placement topology draw.io.
Placement matrix (summary)
| Constraint | First choice | Avoid |
|---|---|---|
| Metro <15 ms RTT | Local Zone | Parent Region alone |
| Must run on your floor | Outposts | Local Zone if law requires customer cage |
| 5G handset MEC | Wavelength | Outposts without mobility path |
| Global 50–200 ms OK | Region + CloudFront | Any edge hardware |
Download the full placement matrix for service availability rows.
Opinionated take: Local Zones before Outposts when compliance allows AWS-operated metro sites. Wavelength only with a carrier contract, otherwise you are paying for unused telco metal.
Connectivity layer
Edge placement fails without hybrid networking:
- Direct Connect (primary) into a networking-account Transit Gateway
- Site-to-Site VPN backup on a separate path
- Route 53 Resolver split-horizon for internal API names
- Non-overlapping CIDR across on-prem, Outposts, and Regional VPCs
Outposts requires a service link to the parent Region. AWS documentation recommends ≥500 Mbps to 1 Gbps redundant bandwidth. Undersize it and instability shows up as “mystery” API timeouts before user load spikes.
For VPC design depth, see VPC networking best practices. This post does not re-teach subnet sizing.
Context (AWS CLI 2.x, networking account):
aws directconnect describe-virtual-interfaces --query 'virtualInterfaces[*].[virtualInterfaceState,bgpStatus]'
aws ec2 describe-transit-gateway-attachments --filters Name=state,Values=availableFull steps: connectivity checklist.
Local Zone vs Outposts in practice
Local Zones extend a parent Region VPC. You create subnets mapped to the Local Zone; EC2 and EBS run locally while control-plane calls may still hit the Region. Service availability is a subset, so verify Local Zone features before promising Aurora shapes.
Outposts export instances that look like Regional EC2 but physically sit in your cage. Use when data residency demands customer-controlled facilities or when hardware (HSM, legacy appliance) cannot move. Capex and colo power are real, so model the latency-cost worksheet before signing a three-year rack order.
Wavelength and 5G
AWS Wavelength zones run in telco data centers at the edge of 5G networks, suited to video distribution, game streaming, and industrial AR with mobility. Prerequisites: carrier partnership, handset routing validated with telco NOC, and acceptance that service catalog is a subset of the parent Region. Wavelength without 5G integration is the most common “edge for edge’s sake” failure we see in architecture reviews.
Residency cross-link
When placement is driven by sovereignty rather than milliseconds, pair this post with the data residency guide, since Outposts and Local Zones satisfy different auditor questions.
What to do this week
- Measure p99 RTT from target metros to parent Region and document it before buying hardware.
- Check Local Zone availability in those metros; run one latency-sensitive API there.
- Inventory workloads that truly need your floor (HSM, OT bridge) vs cacheable reads.
- Validate DX + VPN + TGW against the connectivity checklist.
- If considering Wavelength, get carrier sign-off before architecture review closes.
What this post doesn’t cover
- Snow Family bulk migration: see migration cost surprises.
- Factory OT / OPC-UA edge: OT/IT convergence.
- EC2 vs Lambda cost break-even: hybrid compute guide.
- Full telco 5G core design: requires carrier engineering beyond AWS docs.
Related: VPC networking · Cross-account patterns · Managed services
Frequently asked questions
What is the difference between AWS Local Zones and Outposts?
When should we use AWS Wavelength?
When should we NOT buy AWS Outposts?
How does this differ from hybrid compute (EC2 + Lambda)?
What bandwidth does Outposts need to the parent Region?
What could go wrong during hybrid rollout?
AWS Cloud Architect & AI Expert
AWS-certified cloud architect and AI expert with deep expertise in cloud migrations, cost optimization, and generative AI on AWS.
