A new citizen mobile backend-for-frontend terminates users at CloudFront, then reaches an ALB and private origins. Which encryption-in-transit design should architects mandate?
Select an answer to reveal the explanation.
Short Explanation
Encrypt the whole hallway: citizen to CloudFront, CloudFront to ALB, ALB to origin. Dropping to cleartext behind the edge is leaving the inner doors unlocked.
Full Explanation
Encryption in transit for a public BFF pattern should cover viewer connections and origin fetches—TLS from clients to CloudFront and onward to the ALB and origins as required by policy. Terminating TLS at the edge and continuing in cleartext, or using HTTP-only designs, fails end-to-end confidentiality expectations for citizen traffic.