# AWS Config compliance results proving data in transit is protected by TLS — S3 bucket policies denying non-TLS requests, load-balancer listeners restricted to SSL/HTTPS, and Redshift clusters requiring SSL

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/config-encryption-in-transit

Recipe id: `config-encryption-in-transit` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-SVC-SIN`
- control `sc-8`

## Collection

Kind: `config-rule`

```sh
# s3-bucket-ssl-requests-only
aws configservice get-compliance-details-by-config-rule --config-rule-name s3-bucket-ssl-requests-only --compliance-types NON_COMPLIANT
# elb-tls-https-listeners-only
aws configservice get-compliance-details-by-config-rule --config-rule-name elb-tls-https-listeners-only --compliance-types NON_COMPLIANT
# redshift-require-tls-ssl
aws configservice get-compliance-details-by-config-rule --config-rule-name redshift-require-tls-ssl --compliance-types NON_COMPLIANT
# configuration-recorder-status
aws configservice describe-configuration-recorder-status
# s3-bucket-ssl-requests-only-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names s3-bucket-ssl-requests-only
# elb-tls-https-listeners-only-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names elb-tls-https-listeners-only
# redshift-require-tls-ssl-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names redshift-require-tls-ssl
# describe-regions
aws ec2 describe-regions --query 'Regions[].RegionName' --output text
# list-accounts
aws organizations list-accounts --query 'Accounts[].Id' --output text
```

## Expected output

Three EvaluationResults arrays; an empty NON_COMPLIANT set from each rule means every evaluated S3 bucket enforces aws:SecureTransport, every Classic Load Balancer listener is SSL/HTTPS, and every Redshift cluster sets require_SSL=true. Managed rule identifiers: S3_BUCKET_SSL_REQUESTS_ONLY, ELB_TLS_HTTPS_LISTENERS_ONLY, REDSHIFT_REQUIRE_TLS_SSL Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.

## Assertions

- {"field":"s3-bucket-ssl-requests-only.EvaluationResults","op":"count_eq","value":0,"controls":["sc-8"],"description":"Every evaluated S3 bucket policy denies requests without aws:SecureTransport."}
- {"field":"elb-tls-https-listeners-only.EvaluationResults","op":"count_eq","value":0,"controls":["sc-8"],"description":"Every Classic Load Balancer listener terminates SSL/HTTPS."}
- {"field":"redshift-require-tls-ssl.EvaluationResults","op":"count_eq","value":0,"controls":["sc-8"],"description":"Every Redshift cluster requires SSL."}
- {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["sc-8"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."}
- {"field":"s3-bucket-ssl-requests-only-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-8"],"description":"s3-bucket-ssl-requests-only has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"s3-bucket-ssl-requests-only-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-8"],"description":"s3-bucket-ssl-requests-only has a successful evaluation on record."}
- {"field":"elb-tls-https-listeners-only-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-8"],"description":"elb-tls-https-listeners-only has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"elb-tls-https-listeners-only-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-8"],"description":"elb-tls-https-listeners-only has a successful evaluation on record."}
- {"field":"redshift-require-tls-ssl-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["sc-8"],"description":"redshift-require-tls-ssl has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"redshift-require-tls-ssl-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["sc-8"],"description":"redshift-require-tls-ssl has a successful evaluation on record."}

## GovCloud

AWS Config and all three managed rules are available in AWS GovCloud (US); bucket, load-balancer, and cluster ARNs use partition arn:aws-us-gov

## Notes

The SC-08.01 enhancement (cryptographic protection in transit) is the TLS requirement these rules assert. ELB_TLS_HTTPS_LISTENERS_ONLY covers Classic Load Balancers only — for Application/Network Load Balancers add elbv2-acm-certificate-required and alb-http-to-https-redirection-check, and pair with acm-certificate-expiration-check so the certs terminating TLS are valid. These three cover the dominant public data paths; extend to the services you actually run (e.g. api-gw-ssl-enabled, elasticsearch-node-to-node-encryption-check). ELB_TLS_HTTPS_LISTENERS_ONLY evaluates Classic Load Balancers only and returns NOT_APPLICABLE where there is no listener, so on an ALB/NLB estate that assertion passes having examined nothing; whether the TLS that terminates is FIPS-validated is carried by the listener's SslPolicy, which no command here reads, and a human confirms it — SC-08 (01) is not claimed.

## References

- {"title":"AWS Config managed rule: s3-bucket-ssl-requests-only","url":"https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-ssl-requests-only.html"}
- {"title":"AWS Config managed rule: elb-tls-https-listeners-only","url":"https://docs.aws.amazon.com/config/latest/developerguide/elb-tls-https-listeners-only.html"}
- {"title":"AWS Config managed rule: redshift-require-tls-ssl","url":"https://docs.aws.amazon.com/config/latest/developerguide/redshift-require-tls-ssl.html"}