
AWS Certified Advanced Networking – Specialty (ANS-C01) Certification Guide
By :

In accordance with the shared responsibility model, AWS handles some data-in-transit encryption, while other flows are the customer’s responsibility.
All data traffic between AWS data centers is automatically encrypted at the physical level. Similarly, data exchanged within a VPC and between interconnected VPCs across different Regions is also encrypted at the network level, provided that the Amazon EC2 instance types supporting this feature are used.
At the application level, the customer decides how to implement encryption. The most common option is TLS. AWS service endpoints accommodate TLS, enabling secure HTTPS connections for API requests. Load balancers are a great way to control the parameters of TLS encryption with minimal impact on the workload, assuming that end-to-end encryption is not a requirement.
In a hybrid cloud design, IPSEC may be used for transport encryption between the AWS environment and the on-premises...