I'd like to make sure any communications with my web app are secured.

It's the first web app I develop and I'm really new to this backend/infrastructure world so my question might sound a bit silly.

My app is written in Node.js and I use Express:

var express = require('express'),
    bodyParser = require('body-parser'),
    methodOverride = require('method-override'),
    errorHandler = require('errorhandler'),
    jsdom = require('jsdom'),
    http = require('http'),

...

var server = http.createServer(app).listen(app.get('port'), function () {
// Allow prompt in Node after launching
    repl = require("repl")
    repl.start("> ")
});

This app runs on a AWS's EC2 instance (don't know if the wording is correct) and any communication with the app is secured with HTTPS (I can do API calls to https://my.api.com/get/results, for instance).

Everything works really fine so far but I'm wondering if all of this is safe.

As you may have noticed, I am not using HTTPS with the express server:

http = require('http')

The thing is, as far as I understand, the express server still is "behind" a HTTPS secured portal in my case.

Better asking before releasing unsecured stuff..