A company is building an application to accept data from customers. The data must be encrypted at rest and in transit. The application uses an Amazon API Gateway API that resolves to AWS Lambda…

Changing the viewer protocol policy to HTTPS only affects transport-layer encryption between the client and CloudFront; it has no effect on field-level encryption, which operates at the application layer and is applied before the payload reaches the origin.

CloudFront field-level encryption uses asymmetric encryption to protect specific form fields at the edge using a public key. The encrypted ciphertext is forwarded as-is to the origin Lambda function, which must use the corresponding private key via AWS KMS to decrypt the fields before writing to Aurora. Without this explicit decryption step, the ciphertext is stored directly in the database instead of the original plaintext values.

Enabling Aurora storage encryption with the same KMS key encrypts data at rest in the database but does not decrypt the CloudFront field-level encrypted ciphertext before it is inserted; both layers operate independently.

Deploying a new SSL certificate affects TLS termination at the CloudFront distribution for HTTPS traffic, but has no relationship to field-level encryption, which is a separate application-layer feature that encrypts specific payload fields.