Security & governance
Encryption in transit
Encryption in transit is the protection of data while it travels across a network, so that anyone who intercepts the traffic cannot read or alter it. For storage, it covers requests and data moving between applications and the storage endpoint, between storage nodes, and between sites during replication.
How does encryption in transit work?
Almost all storage traffic is protected with Transport Layer Security (TLS). The client checks the server's certificate to confirm it is talking to the right endpoint, the two sides agree session keys, and everything after that is encrypted and integrity-protected. The S3 API runs over HTTPS, which is HTTP inside TLS. Some environments add mutual TLS, in which the client also presents a certificate, so that both ends are authenticated.
Which network paths need protecting?
The client connection is the obvious one. Several others carry the same data and are easier to overlook.
| Path | What travels | Often missed? |
|---|---|---|
| Application to storage endpoint | Requests, objects, credentials | Rarely |
| Load balancer to storage nodes | The same, after TLS is terminated | Yes |
| Node to node within a cluster | Data fragments, metadata | Sometimes |
| Site to site replication | Full copies of data | Sometimes |
| Storage to key management service | Wrapped keys, key requests | Rarely |
| Management and monitoring | Administrator sessions, logs, metrics | Yes |
How does it relate to encryption at rest?
The two cover different moments. Encryption at rest protects stored data against loss of the media. Encryption in transit protects moving data against interception. Neither substitutes for the other, and data is in plaintext in memory at each end unless it was encrypted by the client beforehand. Security frameworks and regulations generally expect both, and audits ask for evidence of each.
What has to be managed?
Certificates are the operational burden. Each endpoint needs one that clients trust, issued by an internal or public certificate authority, and each expires. An expired certificate on a storage endpoint stops every application and backup job that uses it, so expiry dates need monitoring and renewal should be automated where possible. Protocol versions and cipher suites also need keeping current, with older TLS versions disabled. Finally, a policy should refuse unencrypted connections outright, which in S3 can be expressed as a bucket policy condition.
Frequently asked questions
Is HTTPS the same as encryption in transit?
HTTPS is one form of it, used for web and S3 traffic. Other protocols have their own TLS or equivalent options.
Is encryption needed on an internal network?
Yes in most security models. Internal networks are reachable by compromised systems, and zero trust approaches treat them as untrusted.
Does TLS hide which objects are requested?
The request and its contents are encrypted. An observer can still see which endpoint is contacted and how much data moves.
Related terms
- Encryption at rest: protection for stored data.
- Key management service (KMS): keys for stored data, reached over an encrypted channel.
- S3 API: the storage interface that runs over HTTPS.
- Bucket policy: where encrypted connections can be enforced.
- IAM policy: who is allowed to connect at all.