AWS Introduces VPC Encryption Controls to Enforce Encryption in Transit

"AWS has recently introduced VPC encryption controls, allowing customers to validate whether traffic within and between VPCs is encrypted and to require encryption where supported. The feature provides visibility into unencrypted traffic, supports enforcement using compatible Nitro-based infrastructure, and allows exclusions for resources that cannot encrypt traffic. According to the cloud provider, the new feature helps organizations apply consistent encryption standards across their AWS environments and demonstrate compliance with regulatory frameworks such as HIPAA, PCI DSS, and FedRAMP, which require comprehensive encryption."

"Organizations across financial services, healthcare, government, and retail face significant operational complexity in maintaining encryption compliance across their cloud infrastructure. Traditional approaches require piecing together multiple solutions and managing complex public key infrastructure (PKI), while manually tracking encryption across different network paths using spreadsheets. While the community reaction has been mostly positive, many initially expressed confusion about the pricing approach or questioned why a security control should be paid for at all."

"Administrators can enable the feature for existing VPCs to monitor the encryption status of traffic flows and identify VPC resources that unintentionally allow plaintext traffic. Chris Farris, cloud security consultant and AWS Security Hero, writes in his re:Invent recap: Let's start with why you should avoid this - $110 per month per non-empty VPC. This is absolutely worth it if you need "To meet stringent compliance standards like HIPAA and PCI DSS" and "demonstrate compliance with encryption standards.""

AWS introduced VPC encryption controls to validate whether traffic within and between VPCs is encrypted and to require encryption where supported. The feature provides visibility into unencrypted traffic, supports enforcement on Nitro-based infrastructure, and allows exclusions for resources that cannot encrypt. The controls help apply consistent encryption standards across AWS environments and support regulatory compliance such as HIPAA, PCI DSS, and FedRAMP. Organizations face operational complexity enforcing encryption, including managing PKI and tracking network paths manually. Administrators can enable the feature to monitor traffic flows and identify resources allowing plaintext traffic. Pricing has raised community concerns.

Read at InfoQ