Data in transit: TLS, private paths and inter-node encryption

Requiring TLS when connecting to services

Most AWS endpoints accept HTTPS by default, but several still allow plaintext or old TLS versions unless you say no. The exam asks how to require encryption in transit for a named service, so you need one switch per service. For anything with a resource policy, the switch is the same condition key: aws:SecureTransport.

CloudFront and API Gateway

CloudFront has two hops. The viewer protocol policy controls viewer to edge (Redirect HTTP to HTTPS or HTTPS only) and a security policy sets the minimum TLS version (for example TLSv1.2_2021). The origin protocol policy controls edge to origin (HTTPS only or Match viewer). API Gateway endpoints are HTTPS only; on a custom domain choose a TLS 1.2 security policy, and disable the default execute-api endpoint so clients can only use the custom domain.

{ "Version": "2012-10-17", "Statement": [
  { "Sid": "DenyHTTP", "Effect": "Deny", "Principal": "*", "Action": "s3:*",
    "Resource": ["arn:aws:s3:::pii-data", "arn:aws:s3:::pii-data/*"],
    "Condition": {"Bool": {"aws:SecureTransport": "false"}} },
  { "Sid": "DenyOldTLS", "Effect": "Deny", "Principal": "*", "Action": "s3:*",
    "Resource": ["arn:aws:s3:::pii-data", "arn:aws:s3:::pii-data/*"],
    "Condition": {"NumericLessThan": {"s3:TlsVersion": "1.2"}} } ]}

TLS on load balancers

Load balancers are where most public TLS ends. The exam asks three things: which security policy (TLS versions and ciphers), where TLS ends (at the load balancer, re-encrypted, or passed through), and how to make clients prove who they are with mutual TLS.

Mutual TLS on ALB

With verify mode, the ALB checks the client certificate against a trust store (a PEM bundle of your CA certificates, optionally with revocation lists) and sends details to targets in headers such as X-Amzn-Mtls-Clientcert-Subject. With passthrough mode, it forwards the whole chain in X-Amzn-Mtls-Clientcert and the application verifies it. NLB TLS listeners also end TLS with ACM certificates and security policies, which is useful for non-HTTP TLS traffic.

$ aws elbv2 create-listener --load-balancer-arn $ALB --protocol HTTPS --port 443 \
    --certificates CertificateArn=$ACM_CERT \
    --ssl-policy ELBSecurityPolicy-TLS13-1-2-Res-PQ-2025-09 \
    --default-actions Type=forward,TargetGroupArn=$TG

$ aws elbv2 create-listener --load-balancer-arn $ALB --protocol HTTP --port 80 \
    --default-actions 'Type=redirect,RedirectConfig={Protocol=HTTPS,Port=443,StatusCode=HTTP_301}'

VPC endpoints and PrivateLink

Skill 5.1.2 is about keeping traffic to AWS services off the internet. VPC endpoints let instances in private subnets reach S3, KMS, Secrets Manager and others without an internet gateway or NAT, and they give you two extra policy hooks: an endpoint policy and the aws:SourceVpce condition.

{ "Sid": "OnlyFromOurEndpoint", "Effect": "Deny", "Principal": "*",
  "Action": "s3:*",
  "Resource": ["arn:aws:s3:::payroll", "arn:aws:s3:::payroll/*"],
  "Condition": {"StringNotEquals": {"aws:SourceVpce": "vpce-1a2b3c4d"}} }

Client VPN, Site-to-Site VPN and Verified Access

People and offices also need encrypted paths into AWS. The exam gives a requirement such as “employees on laptops”, “branch office” or “no VPN, check the device” and expects one service. The newest and most tested is AWS Verified Access: zero-trust access to one application at a time.

Client VPN and Site-to-Site VPN details

AWS Client VPN is a managed OpenVPN-based (TLS) endpoint. Authentication is Active Directory, mutual certificate, or SAML federation (alone, or mutual plus one of the other two). Authorization rules decide which networks each group can reach, split tunnel sends only VPC-bound traffic through the VPN, and a client connect handler (Lambda) can run extra checks at connect time. Site-to-Site VPN joins a whole network to a VGW or transit gateway with two IPsec tunnels.

permit(principal, action, resource)
when {
  context.idc.groups has "c242c5b0-6081-1845-6fa8-6e0d9513c107" &&
  context.jamf.risk == "LOW"
};

Nitro encryption and VPC encryption controls

Inside a VPC, many instances already encrypt traffic in hardware. The Nitro System offloads this, so there is no performance cost, but only under certain conditions. VPC encryption controls turn that into something you can prove and enforce.

VPC encryption controls

Monitor mode shows the encryption status of flows through a new flow log field, encryption-status: 0 not encrypted, 1 Nitro-encrypted, 2 application-encrypted, 3 both. Enforce mode blocks features and resources that would allow cleartext inside the VPC. Resources that leave the AWS network, such as internet gateways, NAT gateways and virtual private gateways, can be excluded, and you remain responsible for encrypting those flows. GetVpcResourcesBlockingEncryptionEnforcement lists what still needs migrating.

Encryption controls also extend hardware encryption beyond plain EC2. When you turn on monitor mode, ALBs, NLBs, Fargate and the EKS control plane move automatically to hardware that encrypts natively. A transit gateway encrypts VPC-to-VPC traffic once you turn on its encryption support. Older instance types, RDS, ElastiCache, EMR and similar services you migrate yourself to modern instance types. There are only 8 exclusions: internet gateway, NAT gateway, egress-only internet gateway, peering to a non-enforced VPC, virtual private gateway, Lambda in the VPC, VPC Lattice and EFS. Gateway Load Balancer and Network Firewall can’t run in an enforce-mode VPC, and in enforce mode an NLB can’t terminate TLS (targets must). You can set it for a whole account, or across an organization with a declarative policy.

$ aws ec2 describe-instance-types \
    --filters Name=network-info.encryption-in-transit-supported,Values=true \
    --query "InstanceTypes[*].InstanceType" --output text | tr '\t' '\n' | sort | head -3
c5n.18xlarge
c5n.2xlarge
c5n.4xlarge

$ aws ec2 create-flow-logs --resource-type VPC --resource-ids vpc-0abc \
    --traffic-type ALL --log-group-name vpc-enc \
    --deliver-logs-permission-arn arn:aws:iam::111122223333:role/flowlogs \
    --log-format '${encryption-status} ${srcaddr} ${dstaddr} ${dstport} ${traffic-path}'

Inter-node encryption in clusters

Skill 5.1.3 is about traffic between the nodes of a distributed service: Hadoop and Spark on EMR, distributed training on SageMaker AI, pods on EKS, and search or streaming clusters. Each service has its own setting, and many can only be turned on when the cluster is created.

Other clusters to recognise

Amazon OpenSearch Service: turn on node-to-node encryption and require HTTPS for the domain endpoint with a TLS security policy. Amazon MSK: TLS between brokers and from clients to brokers. ElastiCache (Valkey/Redis OSS): enable in-transit encryption, usually with AUTH or IAM authentication. Amazon EKS: Nitro-based nodes encrypt pod traffic between supported instances automatically; for authenticated, application-level encryption use mTLS from a service mesh or Amazon VPC Lattice.

$ aws emr create-security-configuration --name pii-sec --security-configuration '{
  "EncryptionConfiguration": {
    "EnableInTransitEncryption": true,
    "EnableAtRestEncryption": true,
    "InTransitEncryptionConfiguration": {"TLSCertificateConfiguration": {
      "CertificateProviderType": "PEM", "S3Object": "s3://sec-certs/emr-certs.zip"}},
    "AtRestEncryptionConfiguration": {
      "S3EncryptionConfiguration": {"EncryptionMode": "SSE-KMS", "AwsKmsKey": "alias/emr"},
      "LocalDiskEncryptionConfiguration": {"EnableEbsEncryption": true,
        "EncryptionKeyProviderType": "AwsKms", "AwsKmsKey": "alias/emr"}}}}'

$ aws emr create-cluster ... --security-configuration pii-sec

Cheatsheet extras: Perfect Forward Secrecy, CloudFront certificates and field-level encryption

Three transit topics from your cheat sheet that this lecture only mentioned in passing: Perfect Forward Secrecy (which ciphers to pick), which Region a certificate must live in when CloudFront is involved, and field-level encryption for single sensitive form fields. A short table at the end updates old TLS facts.

Where the certificate must live, and field-level encryption

CloudFront is global, but it reads viewer certificates from ACM in US East (N. Virginia), us-east-1 only. The load balancer behind it uses a certificate from its own Region. So “HTTPS from viewers to CloudFront and from CloudFront to an ALB in eu-west-1 with a custom domain” needs two ACM certificates: one in us-east-1, one in eu-west-1. Route 53 points the domain at CloudFront with an alias record (a CNAME can’t be used at the zone apex).

Field-level encryption lets CloudFront encrypt specific POST form fields (for example a card number) with a public key you upload, right at the edge. Every system between the edge and the one service that holds the private key only sees ciphertext, even after HTTPS has ended at the load balancer.

$ aws elbv2 describe-ssl-policies --names ELBSecurityPolicy-TLS13-1-2-2021-06 \
    --query "SslPolicies[0].Ciphers[].Name"
[ "TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384", "TLS_CHACHA20_POLY1305_SHA256",
  "ECDHE-ECDSA-AES128-GCM-SHA256", "ECDHE-RSA-AES128-GCM-SHA256", ... ]

$ aws elbv2 modify-listener --listener-arn arn:aws:elasticloadbalancing:eu-west-1:...:listener/app/web/... \
    --ssl-policy ELBSecurityPolicy-TLS13-1-2-2021-06

Lecture summary map

Day 4 on one screen.

1. Mind map

2. Match the requirement to the control

3. “If the question says… pick…”

Must-remember cheat sheet

Core quiz

Check the basics first. Pick an answer, then press Check.

Hard quiz

Harder than most real exam questions on purpose, with one “choose two” and one matching question. Aim for 9 out of 12 before Day 5.

Practice test questions (from your mock exams)

These 9 questions match today’s topics. 7 come from your own mock exams (the “practice tests” folder); the wording was tidied, and where a mock answer was out of date or wrong, the explanation says so, with the mock and question number at the end. The last 2 are new exam-style questions (marked “New question”) written in October 2026 from the SCS-C03 exam guide and current AWS documentation, to cover recent changes.

Hands-on lab (30 minutes, low cost)

1. Add the DenyHTTP and DenyOldTLS statements to a test bucket. Try curl http://BUCKET.s3.amazonaws.com/file on a public test object or a presigned URL and see the 403, then the same over https.
2. Run aws elbv2 describe-ssl-policies --query "SslPolicies[?contains(SslProtocols,'TLSv1.3')].Name" and compare a FIPS policy with a PQ policy.
3. In a VPC with a private subnet, create a free S3 gateway endpoint, then a bucket policy that denies when aws:SourceVpce doesn’t match. Test from an instance (via Session Manager) and from your laptop.
4. Run the describe-instance-types filter for encryption-in-transit-supported and check whether your usual instance type is on the list.
5. Create a flow log with ${encryption-status} in the format (needs VPC encryption controls in monitor mode to show values) and look at a few records.
6. Clean up: delete the endpoint, the flow log and the test instance. Skip Client VPN and Verified Access in a personal account unless you delete them quickly; both charge by the hour.