💼 [MSK.6] MSK clusters should disable unauthenticated access

• ID: /frameworks/aws-fsbp-v1.0.0/msk/06

Description

Amazon MSK supports client authentication and authorization mechanisms to control access to a cluster. These mechanisms verify the identity of clients connecting to the cluster and determine which actions clients can perform. An MSK cluster can be configured to allow unauthenticated access, which allows any client with network connectivity to publish and subscribe to Kafka topics without providing credentials. Running an MSK cluster without requiring authentication violates the principle of least privilege and can expose the cluster to unauthorized access. It can allow any client to access, modify, or delete data in Kafka topics, potentially resulting in data breaches, unauthorized data modifications, or service disruptions. We recommend enabling authentication mechanisms such as IAM authentication, SASL/SCRAM, or mutual TLS to ensure proper access control and maintain security compliance.

Similar

• AWS Security Hub
  • https://docs.aws.amazon.com/securityhub/latest/userguide/msk-controls.html#msk-6

Sub Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance