Encryption in Transit (TLS/SSL)

Overview

Encryption in transit protects data as it moves between systems, preventing eavesdropping, tampering, and man-in-the-middle attacks. AWS provides multiple mechanisms to encrypt data in transit, with TLS (Transport Layer Security) being the primary protocol.

Understanding encryption in transit is essential for the SAA-C03 exam because it's fundamental to securing communications between users, applications, and AWS services. You must know how to implement TLS using AWS Certificate Manager (ACM), configure secure endpoints, and understand the differences between public and private certificates.

Key Concepts

TLS Protocol Overview

AWS Certificate Manager (ACM)

ACM simplifies the provisioning, management, and deployment of SSL/TLS certificates:

Certificate Types:
├── Public Certificates (FREE)
│   ├── Issued by Amazon Trust Services
│   ├── Domain Validated (DV) only
│   ├── Auto-renewal every 13 months
│   └── Used with ACM-integrated services
│
└── Private Certificates (PAID)
    ├── Issued by AWS Private CA
    ├── Custom validity periods
    ├── Organization/Extended Validation possible
    └── Used for internal resources

ACM Certificate Validation Methods

Record Name:  _a1b2c3d4e5.example.com
Record Type:  CNAME
Record Value: _x1y2z3.acm-validations.aws.

Note: This record validates domain ownership
      Must remain in DNS for auto-renewal

ACM-Integrated Services

ACM certificates work automatically with these AWS services:

How It Works

Certificate Deployment Flow

1. REQUEST
   └── User requests certificate for domain(s)

2. VALIDATE
   └── DNS validation (add CNAME) OR Email validation

3. ISSUE
   └── ACM issues certificate (13-month validity)

4. DEPLOY
   └── Associate with ALB, CloudFront, API Gateway

5. RENEW
   └── Automatic renewal 60 days before expiry
       (requires DNS validation record to remain)

TLS Termination Options

Server Name Indication (SNI)

Single ALB with multiple certificates:

HTTPS:443 Listener
├── Rule 1: Host = app1.example.com → Target Group 1
│           Certificate: app1.example.com
│
├── Rule 2: Host = app2.example.com → Target Group 2
│           Certificate: app2.example.com
│
└── Default: → Target Group 3
              Certificate: default.example.com

Benefits:
- Multiple domains on one load balancer
- Reduced infrastructure costs
- Simplified management

AWS Service Encryption in Transit

S3 Encryption in Transit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSSLRequestsOnly",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "false"
        }
      }
    }
  ]
}

RDS Encryption in Transit

Enable require_ssl parameter:
  MySQL/MariaDB: require_secure_transport = 1
  PostgreSQL:    rds.force_ssl = 1
  SQL Server:    rds.force_ssl = 1

Connect with SSL:
  mysql -h mydb.xxx.rds.amazonaws.com \
        --ssl-ca=rds-ca-2019-root.pem \
        --ssl-mode=VERIFY_IDENTITY

Certificate bundles available at:
  https://truststore.pki.rds.amazonaws.com/

VPC Endpoint Encryption

Interface Endpoint → AWS Service
        ↓
    Always TLS 1.2+

No additional configuration needed
Traffic encrypted on AWS backbone

Use Cases

Use Case 1: Public Website with HTTPS

Scenario: Deploy a public website with HTTPS using ALB and ACM.

Solution:

• Request public ACM certificate for domain
• Use DNS validation (add CNAME record)
• Create HTTPS listener on ALB
• Configure HTTP to HTTPS redirect
• Cost: FREE (ACM public certificates)

Use Case 2: End-to-End Encryption

Scenario: Financial application requires encryption from client to database.

Solution:

• ACM certificate on ALB (client to ALB)
• Self-signed or Private CA certificate on EC2 (ALB to EC2)
• RDS with require_ssl enabled (EC2 to database)
• VPC endpoints for AWS services (all internal traffic encrypted)

Use Case 3: Internal Microservices with Private CA

Scenario: Microservices need mutual TLS (mTLS) for service-to-service communication.

Solution:

• Deploy AWS Private CA
• Issue private certificates to each service
• Configure mutual TLS authentication
• Automatic certificate rotation via ACM

Use Case 4: Multi-Domain Application

Scenario: Single ALB serving multiple domains with different certificates.

Solution:

• Request ACM certificates for each domain
• Configure ALB HTTPS listener with SNI
• Add host-based routing rules
• Each domain uses its own certificate

Best Practices

ACM Best Practices

1. Use DNS validation over email validation

   • Enables automatic certificate renewal
   • No manual intervention required
   • Keep CNAME records in DNS permanently

2. Request certificates in the correct region

   • CloudFront: us-east-1 only
   • Regional services: Same region as service

3. Use wildcard certificates carefully

   • *.example.com covers one level only
   • Doesn't cover example.com (apex)
   • Consider security implications

4. Monitor certificate expiration

   • Set CloudWatch alarms for ACM events
   • Use AWS Config rule acm-certificate-expiration-check

TLS Configuration Best Practices

1. Enforce minimum TLS 1.2

   • Configure security policies on ALB/CloudFront
   • Use ELBSecurityPolicy-TLS-1-2-2017-01 or newer

2. Use Perfect Forward Secrecy (PFS)

   • ECDHE cipher suites preferred
   • Protects past sessions if key compromised

3. Implement HTTPS redirects

   • ALB listener rules can redirect HTTP to HTTPS
   • CloudFront can enforce HTTPS-only

4. Enable HSTS (HTTP Strict Transport Security)

   • Add header: Strict-Transport-Security: max-age=31536000
   • Prevents downgrade attacks

Private CA Best Practices

1. Use for internal resources only

   • EC2 instances, containers, IoT devices
   • Service-to-service communication

2. Implement certificate hierarchy

   • Root CA → Intermediate CA → End-entity certificates
   • Protect root CA offline when possible

3. Define validity periods appropriately

   • Shorter periods = more security, more rotation
   • Balance security with operational overhead

Common Exam Scenarios

Common Pitfalls

Related Services

Quick Reference

ACM Certificate Limits

ALB Security Policies

ACM Pricing

CLI Commands

# Request public certificate
aws acm request-certificate \
  --domain-name example.com \
  --subject-alternative-names www.example.com \
  --validation-method DNS \
  --region us-east-1

# List certificates
aws acm list-certificates --region us-east-1

# Describe certificate
aws acm describe-certificate \
  --certificate-arn arn:aws:acm:us-east-1:123456789012:certificate/xxx

Test Your Knowledge

Further Reading

• AWS Certificate Manager User Guide
• ACM Best Practices
• ALB HTTPS Listeners
• CloudFront SSL/TLS
• AWS Private CA
• TLS Security Policies