Hybrid Connectivity Encryption

What it is

Traffic between a data centre and AWS crosses networks you do not control. Encryption in transit for hybrid links means choosing a connection type and adding encryption where the connection does not provide it.

The exam tests which options encrypt by default, which do not, and how to add encryption without losing bandwidth.

How it works

AWS Site to Site VPN

Site to Site VPN builds IPsec (Internet Protocol Security) tunnels between your customer gateway device and AWS. Each VPN connection has two tunnels for redundancy, in different Availability Zones. It ends on a virtual private gateway for one VPC, or on a Transit Gateway for many VPCs.

• Traffic is encrypted and authenticated by IPsec, and it crosses the public internet by default.
• Routing can be static or dynamic with BGP (Border Gateway Protocol), and dynamic routing is preferred for failover.
• Accelerated VPN uses AWS Global Accelerator to carry the tunnel over the AWS backbone sooner, for better performance. It is available on Transit Gateway attachments.
• Throughput per tunnel is limited, so large needs use equal cost multi path (ECMP) over multiple tunnels on a Transit Gateway.

AWS Direct Connect

Direct Connect provides a dedicated private network connection from your site to AWS. It gives consistent latency and bandwidth, but it is not encrypted by default. Data on a Direct Connect link is private only in the sense that it does not use the public internet.

To encrypt, choose one of these approaches.

Choose MACsec when you need line rate encryption on a dedicated connection and your equipment supports it. Choose VPN over Direct Connect when you need IPsec and the bandwidth is within tunnel limits. Choose application TLS when only certain flows need protection.

MACsec protects only the leg between your device and the AWS device at the Direct Connect location. After that, traffic travels inside the AWS network, which is not visible to others.

AWS Client VPN

Client VPN is a managed, OpenVPN based service for individual users to reach VPC and on premises resources. It uses TLS, and supports these authentication methods.

• Mutual authentication with client certificates, which can come from ACM or Private CA.
• Active Directory authentication through AWS Directory Service.
• SAML based federation for single sign on.

Authorization rules control which networks each user group can reach, and security groups on the endpoint's network interfaces add another layer. Split tunnel mode sends only the VPC traffic through the VPN and the rest directly to the internet.

Encryption inside AWS

• Between Nitro instances. Traffic between supported instance types within a VPC, or in peered VPCs in the same Region, is automatically encrypted at the hardware level on the network. It does not replace TLS to the application, but adds a protective layer.
• Between Regions. AWS encrypts inter Region traffic on its backbone for VPC peering and Transit Gateway peering. Use application TLS for sensitive flows regardless.
• PrivateLink and endpoints. Connections to AWS APIs use TLS even when they travel through a private endpoint.
• Service to service. Each service has an option, such as in transit encryption for Amazon MSK, ElastiCache and EMR.

Choosing

Resilience and security together

!A data centre with two routers connects over two Direct Connect locations with MACsec on the link to each AWS device and then inside the AWS network, with a Site to Site VPN of two IPsec tunnels over the public internet as backup, all ending at a Transit Gateway or virtual private gateway and the VPC. A single Direct Connect link is a single point of failure. A common design uses two Direct Connect connections at different locations, plus a Site to Site VPN as a backup path. This is cost effective, and the VPN keeps the encryption path available if both private links fail.

Operational controls

Restrict who can create virtual interfaces and gateways with IAM. Use security groups and network ACLs to allow only on premises ranges. Monitor tunnel state with CloudWatch metrics and alarms, and log VPN activity.