Study guide
7.6 Inter-Resource Encryption in Transit: Nitro, EMR, EKS & SageMaker AI
AWS Certified Security – Specialty SCS-C03
Track your progress as you read
Finished sections get a check mark.
1 Chapter 0: Getting Started with the SCS-C03 Exam
0.1 SCS-C03 Exam Format, Domains & Study Strategy
2 Chapter 1: Security Monitoring, Alerting & Threat Detection Services
1.1 Workload Monitoring & Health Check Strategies 1.2 Amazon GuardDuty Architecture & Finding Types 1.3 AWS Security Hub & Automated Conformance Assessment 1.4 Amazon Macie & Automated Data Classification
3 Chapter 2: Enterprise Logging Architecture & Analysis
2.1 Multi-Account CloudTrail & Organization Trails 2.2 Amazon Security Lake & OCSF Log Normalization 2.3 Network Telemetry: VPC Flow Logs & Route 53 Resolver Logs 2.4 Troubleshooting Security Telemetry & Log Ingestion 2.5 Analyzing, Normalizing & Correlating Security Logs
4 Chapter 3: Incident Readiness, Response Planning & Automated Runbooks
3.1 Incident Response Planning & Blast Radius Mitigation 3.2 Testing & Validating Incident Response Plans 3.3 Automated Incident Remediation with EventBridge & Step Functions 3.4 Systems Manager OpsCenter & Incident Manager Runbooks
5 Chapter 4: Digital Forensics, Evidence Preservation & Root Cause Analysis
4.1 Forensic Artifact Capture & Chain of Custody 4.2 Threat Containment & Network Quarantine Techniques 4.3 Correlating Events & Root Cause Analysis with Amazon Detective
6 Chapter 5: Edge Protection, WAF & DDoS Mitigation
5.1 CloudFront Security Headers & Origin Access Control 5.2 AWS WAF Architecture & Advanced Rule Sets 5.3 AWS Shield Advanced & DDoS Defense Architectures 5.4 Edge Integrations: Managed Rule Groups, OCSF Ingestion, IoT Policies & CORS
7 Chapter 6: Compute Workload Hardening, Vulnerability Management & GenAI Security
6.1 Golden AMIs & Container Image Hardening Pipelines 6.2 Amazon Inspector Vulnerability Management & Patch Automation 6.3 Generative AI Security: Amazon Bedrock Guardrails & Model Protection 6.4 Instance Profiles, Service Roles & Execution Roles for Compute 6.5 Secure Administrative Access: Session Manager & EC2 Instance Connect
8 Chapter 7: Network Security, Segmentation, Private Connectivity & Encryption in Transit
7.1 Layered Traffic Filtering: SGs, NACLs & AWS Network Firewall 7.2 Hybrid Connectivity Security: VPN, Direct Connect & MACsec 7.3 Zero-Trust Access & Network Access Analysis 7.4 Enforcing Encryption in Transit: ELB Security Policies, TLS & HTTPS-Only Access 7.5 Private Access: VPC Endpoints, PrivateLink, Client VPN & Verified Access 7.6 Inter-Resource Encryption in Transit: Nitro, EMR, EKS & SageMaker AI
9 Chapter 8: Enterprise Authentication, Federation & Directory Services
8.1 AWS IAM Identity Center & Enterprise IdP Integration 8.2 Amazon Cognito User Pools & Identity Pools 8.3 AWS Security Token Service (STS) & Temporary Credential Workflows 8.4 Troubleshooting Identity & Authentication Failures
10 Chapter 9: Advanced Authorization Architecture & Policy Evaluation
9.1 Complete AWS Policy Evaluation Logic & Decision Flow 9.2 Permission Boundaries & Safe Admin Delegation 9.3 Attribute-Based Access Control (ABAC) with IAM Tags
11 Chapter 10: Least Privilege, Policy Validation & External Access Auditing
10.1 IAM Roles Anywhere & Amazon Verified Permissions 10.2 Auditing External & Unused Access with IAM Access Analyzer 10.3 Analyzing Authorization Failures & Policy Simulation
12 Chapter 11: Cryptographic Services: KMS Architecture & Key Governance
11.1 AWS KMS Architecture, Key Policies & Key Types 11.2 KMS Grants, Encryption Context & Multi-Region Keys 11.3 Imported Key Material (BYOK) & CloudHSM Key Stores
13 Chapter 12: Secrets Management, Sensitive Data Masking & PKI
12.1 AWS Secrets Manager & Systems Manager Parameter Store 12.2 Sensitive Data Masking in Telemetry & Messaging 12.3 AWS Certificate Manager (ACM) & Private CA Architecture
14 Chapter 13: Storage Encryption, Integrity, Lifecycle & Backup Protection
13.1 S3 Encryption Modes & S3 Bucket Keys 13.2 Data Integrity Protection: Object Lock, Vault Lock & Code Signing 13.3 Secure Data Lifecycle, Cross-Account Replication & Backup Vault Lock 13.4 Lifecycle, Backup & Secure Replication Beyond S3: EFS, FSx, DLM, DataSync & Air-Gapped Vaults
15 Chapter 14: Multi-Account Architecture, Organizations & Control Tower Governance
14.1 AWS Organizations Structure, Hierarchy & Resource Control 14.2 AWS Control Tower Landing Zone & Guardrail Framework 14.3 Delegated Administrator Architecture & Root User Governance 14.4 Centralized Resource Sharing with RAM & Service Catalog
16 Chapter 15: Compliance Automation, Infrastructure as Code Security & Auditing
15.1 Infrastructure as Code Security & Multi-Account Deployment 15.2 AWS Config, Conformance Packs & Automated Remediation 15.3 Audit Evidence Collection & Well-Architected Security Reviews
7.6 Inter-Resource Encryption in Transit: Nitro, EMR, EKS & SageMaker AI
Key Takeaways Explain This Topic AI
Supported Nitro instance types encrypt instance-to-instance traffic automatically in the same Region and the same or peered VPCs, but not through load balancers or transit gateways.
VPC Encryption Controls provide a monitor mode to find unencrypted traffic and an enforce mode that allows only encryption-capable resources, with chosen exclusions.
An Amazon EMR security configuration enables in-transit encryption on every node using TLS certificates from a PEM zip file in S3 or a custom provider.
Kubernetes doesn't encrypt pod traffic by default; use Nitro nodes, a service mesh with mTLS, CNI encryption, or VPC Lattice with TLS.
SageMaker AI inter-container traffic encryption protects distributed training traffic between instances and can increase training time.
Last updated: September 2026
7.6 Inter-Resource Encryption in Transit: Nitro, EMR, EKS & SageMaker AI
Encrypting the connection between a client and a load balancer is not enough when regulations require all traffic to be encrypted, including traffic between the nodes of a cluster. Skill 5.1.3, new in SCS-C03, asks you to design inter-resource encryption in transit for services such as Amazon EMR, Amazon EKS, and SageMaker AI, and to understand what AWS Nitro encryption provides automatically.
AWS Nitro Automatic Encryption in Transit
Supported Nitro-based instance types automatically encrypt traffic between instances using authenticated encryption with associated data (AEAD) and 256-bit keys, with no performance penalty and nothing to configure. The encryption applies only when all of these conditions hold:
Both instances use supported instance types.
The instances are in the same Region .
The instances are in the same VPC or in peered VPCs .
The traffic doesn't pass through a virtual network device or service, such as a load balancer or transit gateway .
Traffic that goes through an Application Load Balancer, a Network Load Balancer, or a transit gateway, or to an instance type without this support, must be protected with TLS or another protocol-level mechanism.
VPC Encryption Controls
VPC Encryption Controls give you visibility and enforcement at the VPC level. In monitor mode , you can see which traffic in the VPC is encrypted and which is not (for example, through VPC Flow Logs), which helps you find workloads that still send plaintext. In enforce mode , the VPC allows only resources that support encryption in transit, with explicit exclusions for components you choose, such as internet or NAT gateways. This turns "all traffic in this VPC is encrypted" from a documentation claim into an enforced property.
Amazon EMR
EMR clusters move large amounts of data between nodes during shuffles and replication. Encryption is configured in an EMR security configuration , which is attached to clusters at launch:
Setting What It Protects
In-transit encryption Enables TLS and the open-source encryption features of cluster applications, such as Hadoop MapReduce encrypted shuffle, Spark RPC and block transfer encryption, and Presto or Trino internal communication
Certificate provider TLS certificates supplied as PEM files in a zip archive in Amazon S3, or a custom certificate provider class
At-rest encryption (related) EMRFS data in S3 with SSE-S3, SSE-KMS, or client-side encryption, and local disk encryption with a KMS key
Because a security configuration applies to every node, it is the answer when a question requires encryption between EMR nodes without changing application code. Pair it with Nitro-supported instance types for defense in depth.
Amazon EKS
Kubernetes doesn't encrypt pod-to-pod traffic by default. Options, from least to most work:
Nitro instance encryption : Worker nodes on supported instance types automatically encrypt traffic between nodes in the same VPC, but not traffic through load balancers or between pods on the same node.
Service mesh mutual TLS : A mesh such as Istio issues workload certificates and encrypts and authenticates every service-to-service connection, which also provides identity-based authorization.
CNI-level encryption : Network plugins such as Cilium or Calico can encrypt node-to-node traffic with WireGuard or IPsec.
Amazon VPC Lattice : Service-to-service networking with TLS listeners and IAM-based auth policies, without running a mesh.
Application-level TLS : Services terminate TLS themselves, often with certificates issued by AWS Private CA through cert-manager.
The EKS control plane API endpoint always uses TLS, and envelope encryption of Kubernetes secrets with KMS protects data at rest, not in transit.
Amazon SageMaker AI
Distributed training jobs exchange model parameters and gradients between ML compute instances. Set EnableInterContainerTrafficEncryption to true on training (and hyperparameter tuning) jobs to encrypt that inter-node traffic. It can increase training time and cost because of the encryption overhead. Related controls:
EnableNetworkIsolation blocks the training container from making outbound network calls.
VPC configuration keeps training and inference traffic in your subnets, with VPC endpoints for S3 and SageMaker APIs.
Inference endpoints are accessed over HTTPS; KMS keys encrypt storage volumes and model artifacts at rest.
Other Services with Internal Encryption Settings
- Service Inter-Node or Internal Setting
- Amazon OpenSearch Service Node-to-node encryption (TLS within the domain); once enabled it can't be disabled
Amazon MSK Encryption within the cluster (broker to broker) and a client-broker setting of TLS, TLS and plaintext, or plaintext
- Amazon ElastiCache (Valkey, Redis OSS) In-transit encryption for client and replication traffic
- Amazon DocumentDB / Amazon Neptune TLS for client connections, enforced through cluster parameters
- Choosing the Right Answer
"Encrypt traffic between EC2 instances in the same VPC with no application changes and no performance impact": Nitro-supported instance types .
"Encrypt Spark shuffle and block transfer between EMR nodes": EMR security configuration with in-transit encryption .
"Encrypt communication between instances in a SageMaker AI distributed training job": inter-container traffic encryption .
"Mutually authenticate and encrypt microservice traffic in EKS": service mesh mTLS (or VPC Lattice with TLS and auth policies).
"Prove every flow in the VPC is encrypted, and block non-compliant resources": VPC Encryption Controls .
Specialty Exam Pitfalls
Assuming Nitro encryption covers load balancer or transit gateway paths : It doesn't; use TLS for those hops.
Forgetting the certificate source for EMR : In-transit encryption needs certificates in S3 (PEM zip) or a custom provider.
Confusing at-rest and in-transit controls : KMS encryption of EKS secrets, EBS volumes, or SageMaker volumes doesn't encrypt network traffic.
Ignoring cost and performance notes : SageMaker inter-container encryption can lengthen training; exam answers may mention this tradeoff.