Task Statement 4.3: Implement and maintain confidentiality of data andcommunications of the network.
📘AWS Certified Advanced Networking – Specialty
1. AWS Shared Responsibility Model (Core Concept)
AWS security is split into two parts:
🔵 AWS Responsibility (Security of the Cloud)
AWS is responsible for:
- Physical data centers (servers, cables, networking hardware)
- Network infrastructure (routers, switches, backbone connectivity)
- Hardware security and availability
- Virtualization layer (hypervisor)
👉 AWS ensures the infrastructure is secure and protected from external attacks.
🟢 Customer Responsibility (Security in the Cloud)
Customers are responsible for:
- Data encryption (at rest and in transit)
- Network traffic protection inside AWS
- Configuration of security services
- Access control (IAM, security groups, NACLs)
- Enabling encryption protocols
👉 This is where network encryption comes in.
2. What is Network Encryption in AWS?
Network encryption means protecting data while it is moving between systems.
This is called:
- Data in transit encryption
It prevents:
- Data interception
- Unauthorized reading of network traffic
- Modification of data during transmission
3. Key Idea for the Exam
👉 AWS provides tools for encryption, but you must enable and configure them.
AWS does NOT automatically encrypt all traffic between services.
4. Where Network Encryption is Used in AWS
Network encryption is required in these common scenarios:
4.1 Between User and AWS Services
Example:
- Browser → AWS Application (ALB, API Gateway, S3 website)
Encryption used:
- TLS/SSL (HTTPS)
👉 You must configure:
- SSL certificates (via ACM – AWS Certificate Manager)
- HTTPS listeners on Load Balancers
4.2 Between On-Premises and AWS
Example:
- Corporate data center → AWS VPC
Encryption options:
- IPsec VPN (Site-to-Site VPN)
- AWS Direct Connect with MACsec (optional encryption)
👉 Important exam point:
- Direct Connect is NOT encrypted by default
- VPN uses IPsec encryption automatically
4.3 Between AWS VPCs
Example:
- VPC A → VPC B (cross-account or cross-region)
Encryption options:
- VPC Peering + application-level TLS
- Transit Gateway with encrypted tunnels (VPN attachments)
4.4 Between Services inside AWS
Example:
- EC2 → RDS
- Lambda → DynamoDB
Encryption options:
- TLS encryption (application-level)
- AWS service-managed encryption (where supported)
👉 Not all AWS internal traffic is encrypted automatically, so you must verify service support.
5. AWS Network Encryption Options (Important for Exam)
5.1 TLS / SSL (Transport Layer Security)
Used for:
- HTTPS websites
- API communication
- Database connections
AWS tools:
- AWS Certificate Manager (ACM)
- Application Load Balancer (ALB)
👉 Most common encryption method in AWS
5.2 IPsec VPN Encryption
Used for:
- Site-to-Site VPN
- Client VPN
Features:
- Encrypts traffic over the internet
- Uses IPsec tunnels
- Provides confidentiality + integrity
5.3 MACsec (Layer 2 Encryption)
Used for:
- AWS Direct Connect (dedicated connections)
Features:
- Encrypts data at Layer 2 (Ethernet level)
- Hardware-based encryption
- Strong protection for private connectivity
5.4 AWS Native Service Encryption
Examples:
- S3 SSE (Server-Side Encryption)
- EBS encryption
- RDS encryption
👉 These are mainly “at rest”, but may support encrypted transport depending on service.
6. Responsibility Breakdown (Very Important Exam Table)
| Encryption Type | AWS Responsibility | Customer Responsibility |
|---|---|---|
| TLS Certificates (ACM) | Provides service | Configures HTTPS |
| VPN (IPsec) | VPN service availability | Tunnel configuration |
| Direct Connect | Physical link + optional MACsec support | Enable MACsec if needed |
| Application encryption (TLS) | Tools & infrastructure | Enable TLS in applications |
| Data encryption in transit | Supports encryption features | Must enable and enforce |
7. Common Exam Scenarios
Scenario 1: Secure traffic between EC2 and Load Balancer
✔ Correct answer:
- Use HTTPS (TLS) with ACM certificate
- Terminate TLS at ALB or use end-to-end encryption
Scenario 2: Secure on-premises to AWS connection
✔ Correct answer:
- Use Site-to-Site VPN (IPsec)
OR - Use Direct Connect + MACsec for encryption
Scenario 3: Secure API communication
✔ Correct answer:
- Use TLS/SSL with API Gateway or ALB
Scenario 4: Internal VPC traffic
✔ Correct answer:
- Use application-level TLS
- AWS does NOT automatically encrypt all VPC traffic
8. Key Exam Points to Remember
✔ AWS secures the infrastructure, not your data encryption choices
✔ You must enable encryption for network traffic
✔ TLS is the most common encryption protocol
✔ VPN uses IPsec for secure tunnels
✔ Direct Connect is NOT encrypted unless MACsec is enabled
✔ Encryption is required for compliance and security best practices
9. Simple Summary
- AWS gives the tools for encryption
- Customers must activate and configure encryption
- Network encryption protects data in transit using:
- TLS/SSL
- IPsec VPN
- MACsec (Direct Connect)
- Security is a shared responsibility
