A city council member asks whether requiring HTTPS to DynamoDB means citizen records are encrypted on disk inside AWS. What should the developer explain?
Select an answer to reveal the explanation.
Short Explanation
HTTPS is the armored truck on the road; at-rest encryption is the locked vault in the warehouse. Council needs both stories—TLS does not magically encrypt disks. DynamoDB SSE/KMS covers storage separately.
Full Explanation
Encryption in transit (TLS/HTTPS) protects data while moving between clients and AWS. Encryption at rest protects data on storage media and is configured separately (for DynamoDB, service-managed or customer-managed KMS keys). Enabling HTTPS does not replace at-rest encryption, and DynamoDB does support encryption at rest.