A company is developing an ecommerce application on Amazon EC2 with an Amazon RDS for MySQL database. For compliance, data must be encrypted in transit and at rest. The solution must minimize operational overhead and cost. Which approach meets these requirements?
Choose an answer
Tap an option to check your answer.
Correct answer: Use AWS Certificate Manager (ACM) certificates on an Application Load Balancer (ALB). Deploy self-signed certificates on the EC2 instances. Ensure the database client uses TLS to connect to Amazon RDS. Enable encryption for the RDS DB instance. Encrypt the Amazon Elastic Block Store (Amazon EBS) volumes for the EC2 instances..
Why this is the answer
This option correctly addresses all requirements. Using ACM certificates on an ALB provides managed TLS for external traffic, minimizing operational overhead. Deploying self-signed certificates on EC2 instances for internal communication is a cost-effective way to ensure in-transit encryption within the application tier. Enabling TLS for RDS connections encrypts data in transit to the database. Enabling encryption for the RDS DB instance and encrypting EBS volumes for EC2 instances ensures data is encrypted at rest.
The second option is incorrect because using third-party certificates on EC2 instances adds operational overhead for certificate management and renewal. Secrets Manager is for secret storage, not client-side encryption of application data.
The third option is incorrect