Encryption in Transit, Security Groups, NACLs, and VPC Endpoints

Why in-transit controls are an architecture problem

Encrypting disks does not help if cardholder sessions cross the internet in cleartext, if a security group is wide open because someone expected a network ACL to be stateful, or if private subnets reach kms.amazonaws.com by bouncing through a NAT Gateway onto the public AWS endpoint. Independent OpenExamPrep teaching for SAP-C02 Task 1.2 treats Transport Layer Security (TLS), security groups, network access control lists (network ACLs), route tables, and VPC endpoints as one design, not five trivia lists.

Contour Bank presents a public payments API on an internet-facing Application Load Balancer (ALB) in eu-west-1, keeps application and database instances in private subnets with no internet gateway route, and inspects east-west and egress traffic in a shared inspection VPC. Assessors want TLS at the edge, no accidental public path from the cardholder subnet, and AWS API calls that never need NAT.

TLS and ACM on ALB and CloudFront

TLS authenticates the server (and optionally the client, with mutual TLS) and encrypts the bytes on the wire. On AWS, ACM is how you attach certificates to integrated edges without pasting private keys onto instances.

Put a public ACM certificate on the ALB HTTPS listener (typically TCP 443) in the same Region as the ALB. Redirect HTTP 80 to HTTPS. For a global brand hostname in front of that ALB, attach a CloudFront distribution and request the viewer certificate in us-east-1. Origin protocol should be HTTPS to the ALB so the CloudFront-to-origin hop is not cleartext. ACM certificates are Regional; you cannot copy them. Public names need domain validation (DNS validation is the usual production choice).

Private ACM certificates from AWS Private CA belong on internal ALBs, service-to-service mutual TLS, and exported installs on EC2 or containers. They are the wrong certificate class for a public CloudFront viewer handshake, which requires a publicly trusted certificate.

Do not terminate TLS only on the instance and leave the ALB on HTTP unless you have a specific inspection reason and you still encrypt the remaining hop. For PCI-style stems, the public edge is HTTPS with ACM, and the instance security group accepts 443 (or the ALB-to-target port you chose) only from the ALB security group, not from 0.0.0.0/0.

Security groups versus network ACLs

Security groups attach to elastic network interfaces (instances, ALB ENIs, VPC endpoint ENIs, RDS interfaces). They are stateful: if an inbound request is allowed, the response is allowed even when no outbound rule matches that flow, and the reverse is true for outbound-initiated connections. Rules are allow only. Multiple security groups on one ENI are evaluated as a union of allows. AWS documents that security groups do not filter a short list of VPC metadata paths (DNS, DHCP, instance metadata, and similar). There is no additional charge for security groups.

Network ACLs attach to subnets. They are stateless: an inbound allow does not imply an outbound allow for the return packets. You must write both directions, including ephemeral ports on the return path. Rules are numbered; the lowest matching number wins. Unlike security groups, network ACLs support explicit deny. The default network ACL allows all traffic; a newly created custom network ACL denies all until you add rules. There is no additional charge for network ACLs.

Contour Bank's cardholder subnet uses tight security groups as the primary host firewall and a custom network ACL only where the assessor demanded an explicit subnet-level deny (for example, blocking an old management protocol). Engineers who open SG 443 from 0.0.0.0/0 because they added a NACL allow for the ALB have inverted the model: the NACL is the coarse filter, the SG is the precise one, and the NACL will not remember the return path for them.

Route tables as controls

A route table is not a firewall, but it is how you force a path. Longest-prefix match wins. In inspection designs, application subnet routes send 0.0.0.0/0 (or specific CIDRs) to a Gateway Load Balancer (GWLB) endpoint, a Transit Gateway, or a firewall ENI—not straight to an internet gateway. Missing a default route is a control: private subnets with routes only to local, VPC endpoints, and perhaps a TGW cannot sneak to the internet.

Gateway VPC endpoints install a prefix-list route for Amazon S3 or DynamoDB in the chosen route tables. That route is more specific than 0.0.0.0/0 for those service prefixes in the current Region, so S3 traffic in-Region prefers the endpoint even when a NAT or internet gateway route exists. Traffic to S3 in another Region does not use that prefix list. An exact IP route can override the endpoint route; know that trap when someone advertises a more-specific path.

Contour Bank's shared inspection VPC uses GWLB endpoints plus route tables so spoke VPCs cannot bypass the appliance fleet. That is the same idea as the hybrid-networking inspection chapter, applied here as a data-protection control: you cannot encrypt a flow you never steered through the inspector, and you cannot claim private-only AWS API access if the route table still points APIs at NAT.

Interface endpoints, gateway endpoints, and PrivateLink

A VPC endpoint lets private resources reach a service without an internet gateway, NAT device, VPN, or Direct Connect public VIF.

Gateway endpoints exist for Amazon S3 and Amazon DynamoDB. They are not AWS PrivateLink. You associate them with route tables. AWS documents no additional charge for gateway endpoints. Instances still use the service's public endpoint addresses from a routing perspective, so security groups on the instances and network ACLs on the subnets must allow the path (typically TCP 443 to the service prefix list or its CIDRs). You cannot attach a security group to the gateway endpoint itself. You can attach an endpoint policy.

Interface endpoints are AWS PrivateLink. For each subnet you select, AWS creates a requester-managed endpoint network interface with a private IP. Most AWS APIs (KMS, Secrets Manager, CloudWatch Logs, Amazon ECR, Systems Manager, and many others) and your own PrivateLink endpoint services use this model. The security group on the endpoint ENI must allow inbound TCP 443 from the clients. Private DNS can replace the public service hostname with the endpoint, so SDKs keep using kms.eu-west-1.amazonaws.com without code changes. Interface endpoints incur hourly and data-processing charges; this guide does not invent the dollar figures.

S3 and DynamoDB support both gateway and interface endpoints. Gateway is the usual cost-efficient in-VPC choice. Interface S3 endpoints matter when you need PrivateLink features (from on-premises over Direct Connect/VPN without using a gateway endpoint's route-table model, or from another VPC through PrivateLink). Do not write a design that uses a gateway endpoint for KMS—KMS is interface-only.

AWS PrivateLink as a consumer/provider pattern: the provider places a Network Load Balancer in front of the service and creates an endpoint service. The consumer creates an interface endpoint. CIDR ranges may overlap; that is a classic reason to choose PrivateLink over VPC peering. The consumer initiates. The provider accepts or rejects the connection. Endpoint policies on the consumer side limit which IAM principals can use the endpoint.

Avoiding NAT for AWS APIs

Private subnets often send 0.0.0.0/0 to a NAT Gateway so instances can reach public AWS endpoints. That works, and it encrypts TLS to the public API, but it is a poor professional default for regulated workloads:

• API traffic leaves the VPC toward a public endpoint instead of staying on the Amazon network via PrivateLink or a gateway endpoint.
• NAT processing and data-transfer metering apply; gateway endpoints have no additional charge, and interface endpoints are priced differently from NAT. Compare current pricing rather than inventing a winner-takes-all dollar claim.
• You cannot attach a KMS- or S3-style endpoint policy to a NAT Gateway.
• A future SG or NACL mistake that also allows 443 to the internet becomes an exfiltration path, because the route already exists.

Contour Bank's cardholder and application subnets have no NAT route. S3 uses a gateway endpoint on those route tables. KMS, CloudWatch Logs, and Systems Manager use interface endpoints (often centralized in a shared-services VPC and reached via Transit Gateway when the landing zone has many spokes—know that you still pay interface-endpoint hours, and that the endpoint SG and private DNS design must be correct). Software updates that truly need the internet go through the inspection VPC, not through a shortcut NAT in the CDE.

Shared inspection and this section meet at the route table. If the inspection fleet must see egress, application routes point at GWLB endpoints. If AWS API calls must not be inspected as generic internet (or must not depend on the inspection fleet being healthy for KMS), those prefixes go to VPC endpoints first. Endpoint routes and inspection routes can coexist; longest prefix and prefix-list entries decide. Test that S3 still hits the gateway endpoint after you add a default route to GWLB.

Contour Bank pattern and exam traps

Production pattern: public ACM certificate on the eu-west-1 ALB; CloudFront viewer certificate in us-east-1 if a CDN sits in front; instance SGs allow the ALB SG only; custom NACL deny for the deprecated protocol plus matching inbound/outbound allows; private route tables with S3/DynamoDB gateway endpoints, interface endpoints for KMS and logging, and no NAT; overlapping-CIDR partner connectivity via PrivateLink rather than peering.

Traps. Placing the CloudFront viewer cert only in eu-west-1. Expecting security groups to deny. Forgetting ephemeral ports on a NACL. Using a gateway endpoint for KMS. Assuming interface endpoints are free like gateway endpoints. Using NAT as the PCI answer for private AWS API access. Peer-connecting two VPCs with overlapping CIDRs instead of PrivateLink. Attaching a Private CA certificate as the CloudFront viewer cert.