Skip to main content

🛡️ AWS MSK Cluster Client-Broker Encryption is not enabled🟢

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Managed Streaming for Apache Kafka (MSK) Clusters that are not configured to enforce TLS encryption for data in transit between clients and brokers.

Rationale​

Encryption in transit protects data from unauthorized access, including eavesdropping and man-in-the-middle attacks. Enforcing TLS for client-to-broker communication ensures that sensitive Kafka data remains secure while traversing the network.

Audit​

This policy flags an AWS MSK Cluster as INCOMPLIANT when the Encryption: Client Broker field is set as PLAINTEXT or TLS_PLAINTEXT.

Remediation​

Open File

Remediation​

Enforce TLS Encryption for Client–Broker Communication​

Update the MSK cluster security configuration to require TLS encryption for all data in transit between Kafka clients and brokers.

Ensure that all Kafka producers and consumers are configured to use TLS before applying this change. Clients that do not support TLS will lose connectivity once the update is completed.

From Command Line​
Step 1: Retrieve the Current Cluster Version​

Run the following command to obtain the cluster’s current version, which is required to perform an update:

aws kafka describe-cluster \
  --cluster-arn {{cluster-arn}} \
  --query 'ClusterInfo.CurrentVersion' \
  --output text
Step 2: Update the Cluster Security Configuration​

Execute the following command to enforce TLS encryption for client-to-broker communication. Replace authentication-related values with those appropriate for your environment.

aws kafka update-security \
  --cluster-arn {{cluster-arn}} \
  --current-version {{current-version}} \
  --encryption-info '{

... [see more](remediation.md)

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [MSK.1] MSK clusters should be encrypted in transit among broker nodes1no data
💼 Cloudaware Framework → 💼 Data Encryption67no data
💼 FedRAMP High Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)23799no data
💼 FedRAMP High Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)44no data
💼 FedRAMP High Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)1824no data
💼 FedRAMP High Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)823no data
💼 FedRAMP High Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)1641no data
💼 FedRAMP High Security Controls → 💼 SC-23 Session Authenticity (M)(H)720no data
💼 FedRAMP Low Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)124no data
💼 FedRAMP Low Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)23no data
💼 FedRAMP Low Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)41no data
💼 FedRAMP Moderate Security Controls → 💼 AC-4 Information Flow Enforcement (M)(H)183no data
💼 FedRAMP Moderate Security Controls → 💼 SC-7(4) External Telecommunications Services (M)(H)44no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8 Transmission Confidentiality and Integrity (L)(M)(H)124no data
💼 FedRAMP Moderate Security Controls → 💼 SC-8(1) Cryptographic Protection (L)(M)(H)23no data
💼 FedRAMP Moderate Security Controls → 💼 SC-13 Cryptographic Protection (L)(M)(H)41no data
💼 FedRAMP Moderate Security Controls → 💼 SC-23 Session Authenticity (M)(H)20no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events168no data
💼 NIST CSF v2.0 → 💼 ID.AM-03: Representations of the organization's authorized network communication and internal and external network data flows are maintained84no data
💼 NIST CSF v2.0 → 💼 PR.DS-01: The confidentiality, integrity, and availability of data-at-rest are protected178no data
💼 NIST CSF v2.0 → 💼 PR.DS-02: The confidentiality, integrity, and availability of data-in-transit are protected154no data
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected174no data
💼 NIST CSF v2.0 → 💼 PR.IR-01: Networks and environments are protected from unauthorized logical access and usage116no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-4 Information Flow Enforcement3269114no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-7(4) Boundary Protection _ External Telecommunications Services44no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8 Transmission Confidentiality and Integrity5824no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8(1) Transmission Confidentiality and Integrity _ Cryptographic Protection822no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-8(2) Transmission Confidentiality and Integrity _ Pre- and Post-transmission Handling15no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-13 Cryptographic Protection430no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-23 Session Authenticity514no data
💼 NIST SP 800-53 Revision 5 → 💼 SC-23(3) Session Authenticity _ Unique System-generated Session Identifiers13no data
💼 PCI DSS v3.2.1 → 💼 4.1 Use strong cryptography and security protocols to safeguard sensitive cardholder data during transmission over open, public networks.1828no data
💼 PCI DSS v4.0.1 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.228no data
💼 PCI DSS v4.0 → 💼 4.2.1 Strong cryptography and security protocols are implemented to safeguard PAN during transmission over open, public networks.2928no data