AWS now provides two native ways to encrypt Amazon ECS traffic: VPC encryption controls for network-layer encryption using the AWS Nitro System, and Service Connect TLS for application-layer encryption. This hands-on guide shows how to activate both on AWS Fargate and verify encryption in VPC Flow Logs, giving practitioners concrete steps to secure inter-service communication without third-party tools.
Enable VPC encryption controls for network-layer encryption
VPC encryption controls encrypt traffic at the network layer using the AWS Nitro System, requiring no changes to your application code. To enable it, navigate to the VPC console, select your VPC, and turn on encryption under the encryption controls section. This setting applies to all traffic within the VPC, including between ECS tasks on Fargate, and uses AES-256 encryption with keys managed by AWS KMS.
Once enabled, all packets between ECS tasks are encrypted in transit, protecting against packet sniffing and man-in-the-middle attacks within the VPC. The encryption is transparent to workloads and operates at the hypervisor layer, so there is no performance impact on the CPU or memory of your Fargate tasks. You do not need to modify task definitions or security groups to activate this feature.
To verify encryption is working, check VPC Flow Logs for encrypted traffic indicators. Look for the 'encryption-algorithm' field set to 'AES-256' and the 'encryption-context' field showing the VPC ID. If these fields appear, traffic is being encrypted at the network layer. If absent, double-check that encryption controls are enabled on the VPC and that your subnets are associated with the encrypted VPC.
Configure Service Connect TLS for application-layer encryption
Service Connect TLS provides application-layer encryption for service-to-service communication within ECS, using mutual TLS (mTLS) to authenticate and encrypt traffic. To enable it, create a Service Connect namespace in the ECS console, then configure your service to use the namespace with TLS enabled. You must specify a certificate from AWS Certificate Manager (ACM) for the namespace, which Service Connect uses to establish secure connections.
When a task makes a request to another service via Service Connect, the connection is automatically upgraded to TLS using the ACM certificate. The client and server validate each other's identities before exchanging data, ensuring both confidentiality and integrity. This works across Fargate and EC2 launch types and requires no sidecar proxies or application changes beyond referencing the service by its Service Connect name.
Verify Service Connect TLS is active by checking the logs of your ECS tasks for TLS handshake success messages or by using AWS X-Ray to trace encrypted traces. You can also inspect the Service Connect configuration in the ECS console to confirm TLS is enabled and the ACM certificate is correctly associated. If TLS is not working, ensure the ACM certificate is valid, in the same region, and associated with the namespace.
Walkthrough: Enable and verify encryption on Fargate
Start by enabling VPC encryption controls: open the VPC console, select your VPC, choose Actions > Edit encryption controls, and toggle on encryption. Then, create or update your ECS cluster to use Fargate and ensure it runs in subnets associated with the encrypted VPC. Deploy your task definition as usual—no changes needed for network-layer encryption.
Next, set up Service Connect TLS: in the ECS console, create a Service Connect namespace, request or import a certificate in ACM, and assign it to the namespace. Update your service to connect to other services using the Service Connect discovery name (e.g., 'myservice.namespace.local'). Deploy the updated service; ECS will automatically establish mTLS connections between tasks.
Finally, validate both layers: check VPC Flow Logs for AES-256 encryption-algorithm entries to confirm network-layer encryption, and use ECS service logs or X-Ray to observe successful TLS handshakes for Service Connect traffic. If both show encryption, your ECS workloads are protected at both network and application layers using native AWS controls.
What to do next
To get started, enable VPC encryption controls in your VPC settings and configure a Service Connect namespace with an ACM certificate for TLS. Verify encryption using VPC Flow Logs and service logs. These steps require no application changes and provide defense-in-depth for ECS traffic on Fargate. For production, rotate ACM certificates regularly and monitor Flow Logs for encryption anomalies.
FAQ
Do I need to change my application code to use VPC encryption controls or Service Connect TLS?
No, both features are transparent to applications. VPC encryption works at the network layer via the Nitro System, and Service Connect TLS is handled by the ECS agent and service mesh—no code changes are required.
Can I use VPC encryption controls and Service Connect TLS together?
Yes, they operate at different layers and are complementary. Use VPC encryption controls for network-layer protection and Service Connect TLS for application-layer authentication and encryption—enabling both provides layered security.
Source: Encrypt Amazon ECS traffic: VPC encryption controls and Service Connect TLS (AWS).
