VPC encryption rules, now applied to every VPC with a single policy!

Hey there, it's me! Today I found some news that makes VPC encryption a lot easier to handle, so let me walk you through it. This is a lovely update for anyone in charge of network security!

AWS What's New aws.amazon.com

What was announced?

Over on AWS What's New, AWS announced that VPC Encryption Controls can now be managed with declarative policies.

VPC Encryption Controls is a feature that lets you audit and enforce encryption in transit within and across Amazon VPCs, and it helps you demonstrate compliance with encryption standards like HIPAA, FedRAMP, and PCI.

With this update, you can now turn on Encryption Controls in monitor or enforce mode across all VPCs in your environment, all at once.

The story so far

Until now, you had to turn on Encryption Controls in monitor or enforce mode and set up exclusions on each VPC separately.

But security teams naturally want to apply controls like this centrally and consistently across the whole environment. Configuring them by hand every time a new VPC appears was tedious and easy to miss.

What changes

From now on, you only need to define and maintain a single declarative policy, and your desired encryption controls settings will apply to all existing VPCs and all future ones too.

You can choose the scope, applying it to:

• A single account
• Your entire organization
• A specific organizational unit (OU)

On top of that, you get central visibility into the Encryption Controls status of every account and VPC in your organization. Being able to check "which VPCs are actually configured correctly?" from one place is reassuring, especially during an audit.

Dive Deep

Let me line up the technical points.

• It uses declarative policies in AWS Organizations, a governance feature that declaratively defines and applies your desired settings across the org
• There are two modes, monitor and enforce. You can start with monitor to observe, then switch to enforce once you are ready
• It is available in all AWS regions that support VPC Encryption Controls
• There is no additional charge to use declarative policies in AWS Organizations

For security governance features, applying things "centrally and consistently" really matters, so being able to manage this declaratively from one place is a nice win.

Wrap-up

• You can now manage VPC Encryption Controls with declarative policies
• It evolves from per-VPC configuration to applying settings at the account, organization, or OU level
• A single policy covers both existing and future VPCs with your encryption controls
• You get central visibility into the Encryption Controls status across the whole organization
• It works in every region that supports VPC Encryption Controls, with no extra charge for declarative policies

This update really lands for security and governance folks running AWS across multiple accounts who want encryption in transit enforced consistently org-wide!