Two microservices exchange sensitive permit payloads inside the city’s VPC. A developer claims private subnets make TLS unnecessary. What is the better guidance?
Select an answer to reveal the explanation.
Short Explanation
A private subnet is a fenced yard, not a locked envelope. Sensitive permit JSON still deserves TLS between services—defense in depth. Security groups and NACLs filter paths; they do not encrypt payloads.
Full Explanation
Traffic remaining inside a VPC is not automatically encrypted. For sensitive application data, service-to-service TLS remains a defense-in-depth control even when endpoints are private. Security groups and network ACLs control reachability but do not provide confidentiality of payloads. Publishing internal traffic publicly is not a substitute.