Internet traffic redirect from WAF to Cloud Network - Encrypted vs unencrypted

Question

What are security best practices to determine if WAF should redirect Internet traffic to cloud network as encrypted or unencrypted ?

Answer 1

Best practice is to encrypt all traffic - especially if it touches any network equipment you do not entirely control.

If the WAF is on a different LAN to the server network why would you not encrypt it? If your servers accept unencrypted traffic it to a large extent makes the WAF redundant - a malicious actor could just send the traffic direct.

There have even been instances of security agencies accessing traffic within internal communications. Google now trust absolutely nothing.