More information about Packet-Level VPC encryption?

Question

How is traffic within my VPC encrypted?  We are currently debating whether we need to implement intranet SSL, and the AWS docs suggest that some or all of our intranet traffic is already encrypted.  However, we don't have any understanding or control over the AWS intranet encryption, and we would feel more confident knowing exactly what it entails.  Can you provide more detailed information about how the AWS VPC packet-level authentication and encryption works?

[this page](https://docs.aws.amazon.com/whitepapers/latest/logical-separation/encrypting-data-at-rest-and--in-transit.html) says that:

> All traffic within a VPC and between peered VPCs across regions is transparently encrypted at the network layer when using supported Amazon EC2 instance types.

[this page](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#target-group-protocol-version) claims that:

> Because the load balancer is in a virtual private cloud (VPC), traffic between the load balancer and the targets is authenticated at the packet level, so it is not at risk of man-in-the-middle attacks or spoofing even if the certificates on the targets are not valid.

How is the traffic mentioned in these two statements encrypted and/or authenticated?  What protocols are used, and why should we have confidence in the AWS "transparent encryption" vs malicious internal actors?

Answer

What I do know is that any traffic from the ALB to a target that is using SSL doesn’t strictly follow SSL standards.

The alb does not care if it connects to a target that’s running a self signed cert or a cert that’s expired.

That said you will never know if there’s a “man in the middle”

However, the information you have found regarding vpc traffic encryption is true which is transparent.

If it’s really a concern then end to end encryption may be needed to meet certain controls and standards. That’s I guess a business decision.

Not sure if that helps answer your question.

More information about Packet-Level VPC encryption?

Relevant content