I have an application that is hosted on AWS. It has an Application Load Balancer in its front and it is also attached to the Cloudfront to handle a heavy load. In my case, I have enabled SSL only on Cloudfront and haven't had SSL on ALB. Now the application works fine without any issue. It is showing a secured lock symbol on all browsers. But I had a feeling that the communication between the CloudFront and ALB is not secure. Anyone who tries to intercept the traffic between them can achieve it.
Is there any security risk like that? Can anybody intercept the traffic or all communications inside AWS are secured?
I heard about the SSL offloading feature of AWS ALB where we are not enabling SSL between ALB and EC2 servers behind it. I thought this case is also applicable between Cloudfront and its origin ALB. Is that correct or is there any security issue if we doesn't enable SSL between Cloudfront and ALB.