Introducing VPC encryption controls: Implement encryption in transit inside and throughout VPCs in a Area

Replace November 25, 2025: We clarified the pricing part and encryption strategies in use.

At present, we’re saying digital non-public cloud (VPC) encryption controls, a brand new functionality of Amazon Digital Personal Cloud (Amazon VPC) that helps you audit and implement encryption in transit for all site visitors inside and throughout VPCs in a Area.

Organizations throughout monetary companies, healthcare, authorities, and retail face vital operational complexity in sustaining encryption compliance throughout their cloud infrastructure. Conventional approaches require piecing collectively a number of options and managing advanced public key infrastructure (PKI), whereas manually monitoring encryption throughout totally different community paths utilizing spreadsheets—a course of liable to human error that turns into more and more difficult as infrastructure scales.

AWS Nitro based mostly cases present automated hardware-level encryption by the Nitro System, delivering clear site visitors encryption with no efficiency affect. Utilizing AES-256-GCM encryption (state-of-the-art symmetric encryption), the system anonymizes in-transit site visitors between cases. Whereas this built-in safety is efficacious, organizations want easy methods to increase these encryption capabilities throughout their total VPC infrastructure. They require centralized visibility and management over encryption standing, with out managing advanced key programs or sacrificing efficiency. That is notably vital for demonstrating compliance with regulatory frameworks similar to Well being Insurance coverage Portability and Accountability (HIPAA), Fee Card Trade Information Safety Commonplace (PCI DSS), and Federal Danger and Authorization Administration Program (FedRAMP), the place these frameworks require organizations to display complete encryption throughout their environments.

VPC encryption controls deal with these challenges by offering two operational modes: monitor and implement. In monitor mode, you’ll be able to audit the encryption standing of your site visitors flows and establish sources that permit plaintext site visitors. The function provides a brand new encryption-status subject to VPC movement logs, supplying you with visibility into whether or not site visitors is encrypted utilizing Nitro {hardware} encryption, application-layer encryption (TLS), or each.

After you’ve recognized sources that want modification, you’ll be able to take steps to implement encryption. AWS companies, similar to Community Load Balancer, Utility Load Balancer, and AWS Fargate duties, will robotically and transparently migrate your underlying infrastructure to Nitro {hardware} with none motion required from you and with no service interruption. For different sources, such because the earlier era of Amazon Elastic Compute Cloud (Amazon EC2) cases, you have to to change to fashionable Nitro based mostly occasion sorts or configure TLS encryption at software stage.

You’ll be able to change to implement mode in any case sources have been migrated to encryption-compliant infrastructure. This migration to encryption-compliant {hardware} and communication protocols is a prerequisite for enabling implement mode. You’ll be able to configure particular exclusions for sources similar to web gateways or NAT gateways, that don’t assist encryption (as a result of the site visitors flows exterior of the AWS community).

Different sources have to be encryption-compliant and may’t be excluded. After activation, implement mode offers that every one future sources are solely created on appropriate Nitro cases, and unencrypted site visitors is dropped when incorrect protocols or ports are detected.

Let me present you methods to get began

For this demo, I began three EC2 cases. I exploit one as an online server with Nginx put in on port 80, serving a transparent textual content HTML web page. The opposite two are repeatedly making HTTP GET requests to the server. This generates clear textual content site visitors in my VPC. I exploit the m7g.medium occasion sort for the online server and one of many two shoppers. This occasion sort makes use of the underlying Nitro System {hardware} to robotically encrypt in-transit site visitors between cases. I exploit a t4g.medium occasion for the opposite internet consumer. The community site visitors of that occasion isn’t encrypted on the {hardware} stage.

To get began, I allow encryption controls in monitor mode. Within the AWS Administration Console, I choose Your VPCs within the left navigation pane, then I change to the VPC encryption controls tab. I select Create encryption management and choose the VPC I wish to create the management for.

Every VPC can have just one VPC encryption management related to it, making a one-to-one relationship between the VPC ID and the VPC encryption management Id. When creating VPC encryption controls, you’ll be able to add tags to assist with useful resource group and administration. You too can activate VPC encryption management while you create a brand new VPC.

I enter a Identify for this management. I choose the VPC I wish to management. For present VPCs, I’ve to begin in Monitor mode, and I can activate Implement mode once I’m positive there is no such thing as a unencrypted site visitors. For brand spanking new VPCs, I can implement encryption on the time of creation.

Optionally, I can outline tags when creating encryption controls for an present VPC. Nonetheless, when enabling encryption controls throughout VPC creation, separate tags can’t be created for VPC encryption controls—as a result of they robotically inherit the identical tags because the VPC. After I’m prepared, I select Create encryption management.

Alternatively, I can use the AWS Command Line Interface (AWS CLI):

aws ec2 create-vpc-encryption-control --vpc-id vpc-123456789

Subsequent, I audit the encryption standing of my VPC utilizing the console, command line, or movement logs:

aws ec2 create-flow-logs 
  --resource-type VPC 
  --resource-ids vpc-123456789 
  --traffic-type ALL 
  --log-destination-type s3 
  --log-destination arn:aws:s3:::vpc-flow-logs-012345678901/vpc-flow-logs/ 
  --log-format '${flow-direction} ${traffic-path} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${encryption-status}'
{
    "ClientToken": "F7xmLqTHgt9krTcFMBHrwHmAZHByyDXmA1J94PsxWiU=",
    "FlowLogIds": [
        "fl-0667848f2d19786ca"
    ],
    "Unsuccessful": []
}

After a couple of minutes, I see this site visitors in my logs:

flow-direction traffic-path srcaddr dstaddr srcport dstport encryption-status
ingress - 10.0.133.8 10.0.128.55 43236 80 1 # <-- HTTP between internet consumer and server. Encrypted at hardware-level
egress 1 10.0.128.55 10.0.133.8 80 43236 1
ingress - 10.0.133.8 10.0.128.55 36902 80 1
egress 1 10.0.128.55 10.0.133.8 80 36902 1
ingress - 10.0.130.104 10.0.128.55 55016 80 0 # <-- HTTP between internet consumer and server. Not encrypted at hardware-level
egress 1 10.0.128.55 10.0.130.104 80 55016 0
ingress - 10.0.130.104 10.0.128.55 60276 80 0
egress 1 10.0.128.55 10.0.130.104 80 60276 0

• 10.0.128.55 is the online server with hardware-encrypted site visitors, serving clear textual content site visitors at software stage.
• 10.0.133.8 is the online consumer with hardware-encrypted site visitors.
• 10.0.130.104 is the online consumer with no encryption on the {hardware} stage.

The encryption-status subject tells me the standing of the encryption for the site visitors between the supply and vacation spot deal with:

• 0 means the site visitors is in clear textual content
• 1 means the site visitors is encrypted on the community layer (Degree 3) by the Nitro system
• 2 means the site visitors is encrypted on the software layer (Level7, TCP Port 443 and TLS/SSL)
• 3 means the site visitors is encrypted each on the software layer (TLS) and the community layer (Nitro)
• “-” means VPC encryption controls usually are not enabled, or AWS Move Logs don’t have the standing info.

The site visitors originating from the online consumer on the occasion that isn’t Nitro based mostly (10.0.130.104), is flagged as 0. The site visitors initiated from the online consumer on the Nitro- ased occasion (10.0.133.8) is flagged as 1.

I additionally use the console to establish sources that want modification. It reviews two nonencrypted sources: the web gateway and the elastic community interface (ENI) of the occasion that isn’t based mostly on Nitro.

I may test for nonencrypted sources utilizing the CLI:

aws ec2 get-vpc-resources-blocking-encryption-enforcement --vpc-id vpc-123456789

After updating my sources to assist encryption, I can use the console or the CLI to change to implement mode.

Within the console, I choose the VPC encryption management. Then, I choose Actions and Change mode.

Or the equal CLI:

aws ec2 modify-vpc-encryption-control --vpc-id vpc-123456789 --mode implement

The right way to modify the sources which might be recognized as nonencrypted?

All of your VPC sources should assist site visitors encryption, both on the {hardware} layer or on the software layer. For many sources, you don’t must take any motion.

AWS companies accessed by AWS PrivateLink and gateway endpoints robotically implement encryption on the software layer. These companies solely settle for TLS-encrypted site visitors. AWS will robotically drop any site visitors that isn’t encrypted on the software layer.

While you allow monitor mode, we robotically and regularly migrate your Community Load Balancers, Utility Load Balancers, AWS Fargate clusters, and Amazon Elastic Kubernetes Service (Amazon EKS) clusters to {hardware} that inherently helps encryption. This migration occurs transparently with none motion required from you.

Some VPC sources require you to pick the underlying cases that assist fashionable Nitro hardware-layer encryption. These embrace EC2 Cases, Auto Scaling teams, Amazon Relational Database Service (Amazon RDS) databases (together with Amazon DocumentDB), Amazon ElastiCache node-based clusters, Amazon Redshift provisioned clusters, EKS clusters, ECS with EC2 capability, MSK Provisioned, Amazon OpenSearch Service, and Amazon EMR. Emigrate your Redshift clusters, you need to create a brand new cluster or namespace from a snapshot.

If you happen to use newer-generation cases, you probably have already got encryption-compliant infrastructure as a result of all latest occasion sorts assist encryption. For older-generation cases that don’t assist encryption-in transit, you’ll must improve to supported occasion sorts.

Issues to know when utilizing AWS Transit Gateway

When your VPCs with encryption controls enabled are linked through a Transit Gateway, you’ll must manually activate encryption controls on the Transit Gateway to encrypt site visitors between the VPCs. This may be achieved utilizing the AWS console, the modify-transit-gateway command or API. Enabling encryption on an present Transit Gateway gained’t disrupt the site visitors flowing between VPCs connected to the Transit Gateway.

Site visitors is encrypted throughout all hyperlinks when a Transit Gateway and its connected VPCs have encryption controls in implement mode (with no exclusions).

When making a Transit Gateway by AWS CloudFormation with encryption assist enabled, you want one extra AWS Identification and Entry Administration (IAM) permission: ec2:ModifyTransitGateway. This permission is required as a result of CloudFormation makes use of a two-step course of to create a Transit Gateway. It first creates the Transit Gateway with fundamental configuration, then calls ModifyTransitGateway to allow encryption assist. With out this permission, your CloudFormation stack will fail throughout creation when making an attempt to use the encryption configuration, even when you’re solely performing what seems to be a create operation.

Pricing and availability

You can begin utilizing VPC encryption controls immediately in these AWS Areas: US East (Ohio, N. Virginia), US West (N. California, Oregon), Africa (Cape City), Asia Pacific (Hong Kong, Hyderabad, Jakarta, Melbourne, Mumbai, Osaka, Singapore, Sydney, Tokyo), Canada (Central), Canada West (Calgary), Europe (Frankfurt, Eire, London, Milan, Paris, Stockholm, Zurich), Center East (Bahrain, UAE), and South America (São Paulo).

VPC encryption controls is freed from value till March 1, 2026. The VPC pricing web page might be up to date with particulars as we get nearer to that date.

There isn’t any cost to make use of VPC encryption controls throughout the introductory interval from November 20, 2025 till February 28, 2026.

Starting March 1, 2026, we are going to cost a set hourly fee for VPCs which have encryption controls enabled, in monitor or implement mode, and which have a community interface. While you allow encryption management on a Transit Gateway, AWS will cost the identical hourly fee per VPC connected to the Transit Gateway, no matter their encryption management state.

As common, the VPC pricing web page has the small print.

To study extra, go to the VPC encryption controls documentation or attempt it out in your AWS account. I look ahead to listening to how you utilize this function to strengthen your safety posture and enable you meet compliance requirements.

— seb