Encrypting traffic between Amazon Elastic Container Service (Amazon ECS) workloads is a common security and compliance requirement. Virtual private cloud (VPC) encryption controls and Service Connect TLS give you two native ways to encrypt traffic between Amazon ECS workloads. Choosing the right approach means balancing security coverage against operational complexity. Traditionally, implementing encryption meant managing certificates, modifying application code, or deploying sidecar proxies, all of which add operational complexity.
In this post, you learn how to set up VPC encryption controls for network-layer encryption through the AWS Nitro System. You also learn how to verify encryption status in VPC Flow Logs. You also compare VPC encryption controls with Service Connect TLS to identify the right fit for your workload. A hands-on walkthrough shows you how to activate VPC encryption controls on a VPC running AWS Fargate tasks. You then confirm that traffic is encrypted at the network layer and verify that Service Connect TLS is issuing certificates for application-layer encryption.
Amazon Virtual Private Cloud (Amazon VPC) provides VPC encryption controls, a capability that gives you centralized visibility and enforcement of encryption in transit for traffic within and across VPCs in a Region. For Amazon ECS workloads running on AWS Fargate (the serverless compute engine for containers), the setup requires no code changes. When you activate VPC encryption controls in monitor mode, encryption takes effect automatically. It applies the next time a task is replaced through a new deployment, rolling update, or platform version refresh.
The encryption is transparent to your application, with no sidecar containers or certificate management required. VPC encryption controls operates in two modes. Monitor mode adds an encryption-status field to VPC Flow Logs. With this field, you can see your encryption posture before making changes and audit traffic between any resources in your VPC without modifying your application. The possible values of the encryption-status field in the VPC Flow Logs are: Enforce mode goes further, preventing the creation or attachment of resources that allow unencrypted traffic within the VPC.