I would generally recommend controlling encryption explicitly in situations where it's considered important to have encryption. One practical point I'd like to add to the advice offered by others is that when an ALB or NLB is configured with a target group set to use TLS, the load balancer won't validate the target's TLS certificate in any way. The load balancer will accept self-signed certificates just as well as ones issued by a public CA, and it won't care if the certificate is expired or if the name is "localhost", an IP address, or anything else generally not acceptable. The reasoning is that the physical and logical layer security measures in VPCs are a massively more effective defence against man-in-the-middle attacks than a strategy relying on authenticating with TLS certificates based on the expectation that their private keys would be kept secret for the one or more years that the certificate is valid, despite having to be stored in a file on a virtual server's disks, included in backups, possibly exported inadvertently by operators, and so on. This is documented here for ALBs but also applies to NLBs: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-target-groups.html#target-group-routing-configuration This generally makes it effortless and maintenance-free simply to enable TLS encryption for connections between ALBs/NLBs and their targets, without having to consider certificate issuance or renewals. Explicitly enabling TLS also ensures that traffic is always encrypted in transit for the entire distance between the AWS resource where one end of the TLS connection is configured (like your ALB), all the way to the middleware or operating system layer on the EC2 instance where TLS is set to be terminated. Any middleware/application components that might take an interest would also see connections arriving over TLS instead of cleartext HTTP.

If you're talking about Nitro VPC card, then yes all network traffic is encrypted by the Nitro VPC controller. https://docs.aws.amazon.com/whitepapers/latest/security-design-of-aws-nitro-system/the-components-of-the-nitro-system.html