I am working on a project where I need to send messages to a partner via AWS PrivateLink. Because these messages contain PII, the data needs to be secure. I have been unable to determine from internet searching whether data transmitted over PrivateLink is encrypted. Is it encrypted or am I responsible for providing this service?
If the latter, how would I go about doing that? It seems that typical transport-layer encryption such as TLS cannot work here because the actual TCP connections between the VPCs are through VPC endpoints (i.e. outside of my control). Does this mean that I'd have to implement some kind of application-layer encryption? Or perhaps if I send TLS-encrypted traffic to the VPC endpoint, it will just forward along to the destination no problem?