I have an application that is hosted on AWS. It has an Application Load Balancer in its front and it is also attached to the Cloudfront to handle a heavy load. In my case, I have enabled SSL only on Cloudfront and haven't had SSL on ALB. Now the application works fine without any issue. It is showing a secured lock symbol on all browsers. But I had a feeling that the communication between the CloudFront and ALB is not secure. Anyone who tries to intercept the traffic between them can achieve it.

Is there any security risk like that? Can anybody intercept the traffic or all communications inside AWS are secured?

I heard about the SSL offloading feature of AWS ALB where we are not enabling SSL between ALB and EC2 servers behind it. I thought this case is also applicable between Cloudfront and its origin ALB. Is that correct or is there any security issue if we doesn't enable SSL between Cloudfront and ALB.


I would say the short answer is: a compromise is possible.

It would seem that defense-in-depth applies here. Not using SSL assumes that the environment is completely trustworthy and secure, and always will be. Such an assumption has lead to many incidents.

Put another way - there is no risk assuming that all of the following is always true:

  1. you do - and always will - fully control and trust the VPC that hosts it;
  2. that you do - and always will- fully control and trust all the instances involved (and new ones that may be introduced);
  3. that you do - and always will - fully control and trust all the traffic that will ever traverse the VPC;
  4. that you will never have an incorrectly - or maliciously - configured perimeter control;
  5. that there will never be a vulnerability in any of the components that could lead to man-in-the-middle or other types of compromise;
  6. that the environment will never be exposed to any malicious actor (individual or software);
  7. that there is little-to-no potential loss if the systems or information involved are compromised, damaged, or lost.

Since it would be unlikely that one could say with certainty that all of the above will always be true, it is usually wise to use encrypted communications at all times. Given that the functionality is readily available, and the overhead impact is negligible, it would seem best to simply use it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.