canonical: https://jentic.com/apis/amazonaws.com/aws-cloud-map

# AWS Cloud Map

Jentic publishes the only available OpenAPI specification for AWS Cloud Map, keeping it validated and agent-ready. Cloud Map is the AWS service-discovery layer for microservices: it lets applications register service instances with a custom name, attach health checks, and resolve them via DNS or an HTTP API at runtime. Agents can create public or private DNS namespaces, define services with DNS or HTTP-only configurations, register and deregister instances, run DiscoverInstances queries, and inspect operation status. The 26 operations cover namespaces, services, instances, and discovery.

## For AI agents

Register and discover service instances dynamically across microservices using AWS Cloud Map. Agents can create namespaces, register instances, and resolve services via DiscoverInstances.

## Scope

Does not perform load balancing, service-mesh routing, or DNS hosting outside its managed namespaces - use for service registration and discovery only.

## Capabilities

- Create public, private DNS, or HTTP namespaces with CreateHttpNamespace, CreatePrivateDnsNamespace, CreatePublicDnsNamespace
- Define services within a namespace and configure their DNS records or health-check behaviour
- Register service instances with attributes via RegisterInstance for clients to discover
- Resolve services at runtime with DiscoverInstances, optionally filtered by attributes and health
- Inspect health status across all instances in a service with GetInstancesHealthStatus
- Track long-running namespace and service operations through GetOperation and ListOperations

## Use cases

### Service Discovery for Containerised Microservices

Teams running ECS, EKS, or hybrid workloads use Cloud Map as a runtime registry. Each service registers itself with attributes such as version and zone, callers use DiscoverInstances to resolve healthy targets, and Cloud Map returns up to eight matching records. Health checks on Route 53 or custom HealthCheckCustomConfig keep unhealthy instances out of results.

Example prompt: CreatePrivateDnsNamespace 'internal.local' on a VPC, CreateService 'orders' under it, RegisterInstance with InstanceId='orders-1' and Attributes containing IPv4 and PORT, then DiscoverInstances to confirm resolution.

### Hybrid Service Registry with HTTP Namespaces

When clients cannot use DNS - for example, agents running outside the VPC - an HTTP-only namespace combined with DiscoverInstances replaces DNS resolution with an authenticated HTTP lookup. This lets non-AWS workloads register and discover services through the same Cloud Map control plane.

Example prompt: CreateHttpNamespace 'agents-mesh', CreateService inside it, RegisterInstance for an off-VPC worker, then DiscoverInstances filtered by HealthStatus=HEALTHY.

### Operations and Drift Tracking

Long-running Cloud Map operations (namespace creation, service updates, deregistration) return an OperationId. Operators use GetOperation and ListOperations to track completion and detect failures, surfacing drift between intended and actual registry state.

Example prompt: Call ListOperations filtered by Status=PENDING, then GetOperation for each returned id to summarise which namespace or service operations are still in flight.

### AI Agent Service Resolution via Jentic

AI agents using Jentic can resolve internal services on demand without holding AWS SDKs or DNS resolvers. The agent searches by intent, loads the DiscoverInstances schema, and executes against vault-stored AWS credentials to obtain healthy targets.

Example prompt: Search Jentic for 'discover service instances in cloud map', execute DiscoverInstances for NamespaceName='internal.local' and ServiceName='orders' with HealthStatus=HEALTHY, and return the resulting Instances array.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| POST | /#X-Amz-Target=Route53AutoNaming_v20170314.CreatePrivateDnsNamespace | Create a private DNS namespace inside a VPC |
| POST | /#X-Amz-Target=Route53AutoNaming_v20170314.CreateHttpNamespace | Create an HTTP-only namespace for service discovery |
| POST | /#X-Amz-Target=Route53AutoNaming_v20170314.CreateService | Define a service within a namespace |
| POST | /#X-Amz-Target=Route53AutoNaming_v20170314.RegisterInstance | Register a service instance with attributes |
| POST | /#X-Amz-Target=Route53AutoNaming_v20170314.DiscoverInstances | Resolve healthy instances for a service |
| POST | /#X-Amz-Target=Route53AutoNaming_v20170314.DeregisterInstance | Remove an instance from a service |
| POST | /#X-Amz-Target=Route53AutoNaming_v20170314.GetOperation | Inspect an async operation by id |

## Key resources

- **Namespaces** — Public DNS, private DNS, and HTTP namespaces; CreateHttpNamespace, CreatePrivateDnsNamespace, CreatePublicDnsNamespace, ListNamespaces
- **Services** — Service definitions within a namespace; CreateService, GetService, ListServices, UpdateService, DeleteService
- **Instances** — Registered service endpoints; RegisterInstance, DeregisterInstance, ListInstances, GetInstance
- **Discovery** — Runtime resolution via DiscoverInstances; health via GetInstancesHealthStatus, UpdateInstanceCustomHealthStatus
- **Operations** — Async control-plane operation tracking; GetOperation, ListOperations

## Why Jentic

- **Setup:** Wiring AWS Cloud Map by hand means computing SigV4 signatures on every request, picking the right regional servicediscovery host, and handling the X-Amz-Target action routing yourself. Through Jentic you install once, import AWS Cloud Map from the API Directory, store the access keys once, and your agent calls it.
- **Permission scoping:** Cloud Map's actions route through a single endpoint by X-Amz-Target rather than resource ids in the URL path, so scope the agent to the operations it needs, such as DiscoverInstances and RegisterInstance. You choose the operations it may call, so destructive ones like DeregisterInstance or DeleteService are not included unless you add them.
- **Credential handling:** Your AWS access keys are stored once, encrypted, by your own Jentic One instance and used to sign each Cloud Map request with SigV4 at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'discover service instances' or 'register an instance', and Jentic returns the matching Cloud Map operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Amazon Route 53** — DNS hosting that backs Cloud Map's public and private DNS namespaces
- **AWS App Mesh** — Service mesh that integrates with Cloud Map for service-to-service routing
- **Amazon EKS** — Kubernetes-native service discovery via the Kubernetes API; an alternative to Cloud Map inside a single cluster

## FAQ

### Why is there no official OpenAPI spec for AWS Cloud Map?

AWS does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call AWS Cloud Map via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the AWS Cloud Map use?

Cloud Map uses AWS Signature Version 4 with IAM credentials and permissions on the servicediscovery:* actions. Through Jentic, the AWS access key and secret are stored encrypted in the vault and SigV4 signing happens server-side - the agent never handles the raw credential.

### Can I discover services without using DNS?

Yes. HTTP-only namespaces and the DiscoverInstances API let clients resolve services over HTTPS without a DNS resolver. This is the recommended path for clients outside the namespace's VPC or for agents that cannot perform DNS lookups.

### What are the rate limits for the AWS Cloud Map?

Cloud Map applies standard AWS throttling - control-plane operations like CreateService are limited to a few requests per second per account, while DiscoverInstances supports higher throughput suited for runtime resolution. Throttled calls return a ThrottlingException; retry with exponential backoff.

### How do I register a service instance through Jentic?

Through Jentic, search for 'register a service instance in cloud map', load the RegisterInstance schema, and execute with ServiceId, InstanceId, and the Attributes map (typically AWS_INSTANCE_IPV4 and AWS_INSTANCE_PORT). Jentic returns the OperationId so the agent can poll completion via GetOperation.

### Is AWS Cloud Map free?

Cloud Map charges per registered service per month and per million DiscoverInstances API calls. Health checks billed by Route 53 apply when DNS-based health checking is enabled; see https://aws.amazon.com/cloud-map/pricing/ for the current rates.

### Can I limit what my agent is allowed to do with the AWS Cloud Map API?

Yes. Because Jentic One is self-hosted, your own rules decide which Cloud Map operations and credentials the agent may use, and Cloud Map routes every action through a single endpoint by X-Amz-Target rather than resource ids in the path, so you scope the agent to just the operations it needs, such as DiscoverInstances and RegisterInstance. Destructive operations like DeregisterInstance or DeleteService stay out of reach unless you explicitly add them. The AWS access keys are held encrypted by your own instance and used to sign each request at execution time, so the agent can only ever call the operations you have granted.