The traffic from ALB and your Fargate task is inside your VPC. After you deployed an ALB, you can see in the network interfaces section (in the EC2 in console) that there are some network interfaces for the ALB. Same for the task. So the traffic uses the protection of transit on a VPC.
https://docs.aws.amazon.com/whitepapers/latest/logical-separation/vpc-and-accompanying-features.html
Anyway it's highly suggested to implement TLS from ALB and your task, for a zero trust network. ALB doesn't validate the certificate from your task, this means that you can create a self signed certificate, this give you the ability to still encrypt your traffic. https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html
The load balancer establishes TLS connections with the targets using certificates that you install on the targets. The load balancer does not validate these certificates. Therefore, you can use self-signed certificates or certificates that have expired. Because the load balancer is in a virtual private cloud (VPC), traffic between the load balancer and the targets is authenticated at the packet level, so it is not at risk of man-in-the-middle attacks or spoofing even if the certificates on the targets are not valid.
Relevant questions
Network path between ALB and ECS Fargate task
Accepted Answerasked 8 months agoHow to set the subnet priority of ecs Fargate task
Accepted Answerasked 2 months agoCan ALB route traffic except path?
asked 2 months agoDoes ALB send SNI information in TLS handshake to a back-end server
asked 5 months agoMixing ECS Fargate IPV6 and Network Load Balancers
asked 3 months agoECS Fargate + Service Discovery + ALB
Accepted Answerasked 4 years agoALB Rewrite-path and alter
asked 8 months agoIs it possible to change the assignPublicIp setting of running ecs fargate to disable?
asked a month agoEnd-to-end encryption (to be or not to be)
asked 2 months agoECS fargate service with ALB deployed using CDK
asked 4 months ago
Thanks, that's great. Just begs the question as to what TLS adds here, as it is, afaik, solely a mean to protect against MITM.
Many customers have a "encrypt everywhere" policy which is why they would deploy TLS between the ALB and the workload (Fargate in this case). They might have that policy because of internal reasons or because of legislation or industry requirements. What does it add? Eavesdropping protection on the AWS network. As Miki says - zero trust networking.