Question

A financial services company is designing a new three-tier web application on AWS. The application processes sensitive customer PII. Compliance requirements mandate that all data be encrypted in transit and at rest, that database credentials never be hardcoded, and that each tier only be able to communicate with adjacent tiers. The web tier runs on EC2 behind an ALB, the application tier runs on EC2 in private subnets, and the data tier uses Amazon RDS for PostgreSQL. A solutions architect must design the security architecture to enforce least privilege and protect the credentials. Which combination of controls BEST satisfies these requirements?

Accepted Answer

Use TLS end-to-end via ACM certificates on the ALB and re-encryption to the application tier, enable RDS storage encryption with a customer managed KMS key, store credentials in AWS Secrets Manager with automatic rotation, and use tier-specific security groups that reference each other as sources to restrict traffic to adjacent tiers.

Answer

Terminate TLS at the ALB and use HTTP internally, enable RDS encryption with a default AWS managed key, store database credentials in an S3 bucket accessed via an IAM role, and use one shared security group for all three tiers.

Answer

Terminate TLS at the ALB, place all tiers in a single subnet secured with NACLs, enable RDS encryption, and embed database credentials in an encrypted EC2 user-data script pulled at launch.

Answer

Use TLS end-to-end, enable RDS encryption with a customer managed key, store credentials in Systems Manager Parameter Store as plaintext String parameters, and open security groups to the full VPC CIDR to simplify inter-tier communication.