c3.14 Encrypt data in transit
AWS services that move data support encryption in transit with secure protocols. Encrypt whenever sensitive data is transmitted, or better, encrypt everything in transit so nothing sensitive is ever sent in the clear by mistake. Manage certificates with AWS Certificate Manager.
Implementation guidance
Encrypt everything in transit
Every AWS service that moves data supports encryption in transit over secure protocols. Rather than deciding case by case, adopt "encrypt everything in transit" so a mistake never leaves sensitive data unencrypted on the wire. Configure load balancer listeners to use secure protocols (HTTPS/TLS), and enable in-transit encryption on services like Site-to-Site/Client VPN, DataSync, Storage Gateway, Database Migration Service, and AWS Backup.
Automate certificates with ACM
Use AWS Certificate Manager (ACM) to provision, and automatically renew and rotate, TLS/SSL certificates on Application Load Balancers, CloudFront, and API Gateway — avoiding outages from expired certificates. For internal applications, AWS Private CA issues and rotates private certificates automatically.
How it fits together
How to validate
- Do load balancer listeners and public endpoints use secure protocols (TLS)?
- Have you adopted "encrypt everything in transit" rather than deciding case by case?
- Are certificates managed and auto-rotated with ACM (and Private CA for internal apps) to avoid expiry?
Threats addressed
- Data sent without encryption in transit can be intercepted on the network (man-in-the-middle), exposing credentials or sensitive data; an expired certificate can also cause outages or push users to bypass warnings.
AWS services
AWS Certificate Manager 
AWS Private CA 
Amazon CloudFront Pricing
Public TLS/SSL certificates from AWS Certificate Manager (ACM) are free. See ACM pricing (AWS Private CA is billed separately).