This configuration exposes sensitive data to potential interception, as connections are transmitted in plaintext without encryption. Such a setup increases the risk of data breaches and non-compliance with modern security and privacy standards.
An attacker intercepts traffic between a client and an Application Load Balancer that is not configured to use HTTPS or TLS. Because the connection is unencrypted, the attacker can easily capture sensitive data, such as login credentials or session tokens, by performing a man-in-the-middle attack. This can lead to data breaches, unauthorized access, or even identity theft.
