Question

A financial services company runs a three-tier application across multiple Availability Zones in a single VPC. A new compliance requirement mandates that ALL data in transit between EC2 instances be encrypted, including intra-VPC traffic between the application tier and the database tier that today uses an unencrypted TCP protocol the database engine cannot upgrade. The security team wants a solution that guarantees encryption at the network layer without depending on the application to implement TLS, and with the least ongoing operational overhead. Which approach BEST meets these requirements?

Accepted Answer

Rely on the AWS-managed physical layer encryption that automatically encrypts all traffic between instances that use supported Nitro instance types within the same Region.

Answer

Enable VPC traffic mirroring on the application tier ENIs and forward the mirrored packets through an encrypted GWLB appliance before reaching the database tier.

Answer

Deploy AWS Network Firewall between the two subnets and enable its stateful TLS inspection engine to encrypt the connection transparently.

Answer

Configure a security group rule referencing the database tier that forces the kernel to negotiate IPsec on all matching flows.