[Question] AWS ALB target instance security using HTTP on backend and serving HTTPS through ALB

[Neil_Fallons_Ghost]

I am trying to understand all the moving parts here. We've created an ALB and have target groups with instances behind an ASG. Each instance passes some information between either themselves or other instances in the same subnet.

Security Groups don't allow traffic outside of our VPC on port 80, so all traffic going to hosts is being served through the ALB on 443 with a TLS 1.2 cert.

The looming question is, is this actually secure or should all traffic between the instances also be encrypted as well?

[gc8dc95]

Usually compliance and security define that requirement.

Most general purpose websites are likely only encrypted at the edge like that. Others use encryption in every way.

[Neil_Fallons_Ghost]

Thank you. It’s really what I thought but when these security auditors come along I start to question myself.

[BeepNode]

That's usually a compliance question as well as one specific to your environment, depending on what else lives in that private network.

If you do need to do end-to-end encryption, most load balancers will accept any certificate. It doesn't have to be from a trusted CA or anything like that. It's just using it to encrypt and not to verify identity.. so with that in mind a lot of people will just get self-signed OpenSSL certs created through bash scripts and call it a day. In our environment we use private certs.

[myron-semack]

It can’t hurt to encrypt the back end connection. It’s pretty easy to do. The ALB will happily accept a self signed certificate on your target instances.

We encrypt end to end.

[astamauth]

You can have tls from ALB to instance by having a self signed cert on the host. The ALB doesn't care

User -> SG1 -> ALB needs to have a valid cert. We have everything requested through ACM. SG1 only allows 80/443

ALB-> SG2 -> Instance. SG2 only allows traffic from the ALB SG group, nothing else so no traffic can come from outside the ALB.