Protecting Data in Transit

Making encryption on the wire non-optional: ELB security policies and TLS termination choices, explicit denies on aws:SecureTransport, PrivateLink and VPC endpoints as private paths you can require, and inter-node encryption for EMR, EKS, SageMaker AI, and the Nitro System.

Content current as of 2026-10.

Lessons

1. Requiring encryption on the wire
2. Private paths: PrivateLink and VPC endpoints
3. Inter-node and in-fleet encryption

Sources

• SCS-C03 exam guide — Content Domain 5 (task 5.1)
• Elastic Load Balancing — TLS listeners and security policies
• Amazon S3 — policies requiring encryption in transit
• AWS PrivateLink and VPC endpoints
• Amazon EC2 — encryption in transit on Nitro instances