Resident PII moves from a public citizen portal to internal APIs an…

Question

Resident PII moves from a public citizen portal to internal APIs and must remain encrypted in transit across public TLS termination and private backend hops. Which design best satisfies encryption-in-transit requirements?

Accepted Answer

Terminate TLS at the public-facing load balancer or CloudFront using ACM certificates, and continue TLS (or equivalent encrypted transport) on private hops to internal APIs so PII is not sent in cleartext on intermediate segments. — Encrypting the front door and then whispering secrets down an open hallway is not really encryption in transit. Keep TLS (or equal crypto) on the private hops too after the ALB or CloudFront. Cleartext inside the VPC still exposes resident PII to anyone on that path.

Answer

Terminate TLS at the edge and forward HTTP cleartext on all internal VPC segments without further protection.

Answer

Disable TLS on the public portal to improve latency for mobile residents.

Answer

Transmit PII only in URL query strings over HTTP so intermediaries can cache responses.

Resident PII moves from a public citizen portal to internal APIs and must remain encrypted in transit across public TLS termination and private backend hops. Which design best satisfies encryption-in-transit requirements?

Short Explanation

Full Explanation