Check ID: kafka_cluster_encryption_at_rest_uses_cmk
Provider: AWS
Service: kafka
Severity: MEDIUM
Categories: encryption
Resource type: AwsMskCluster

​
What this check verifies

Amazon MSK clusters are inspected for encryption at rest using a customer-managed KMS key for data volumes. Serverless clusters are inherently encrypted. Provisioned clusters are recognized only when the configured DataVolumeKMSKeyId corresponds to a customer-managed key.

​
Risk

Relying on service-managed keys weakens confidentiality and accountability: you can’t enforce granular key policies, separation of duties, or independent rotation. This limits incident response (e.g., disabling the key for crypto-shredding) and reduces auditability, increasing impact of credential misuse or broker compromise.

​
Recommendation

Use a customer-managed KMS key for MSK at-rest encryption. Apply least privilege in key policies and grants, enable key rotation, and log key use for auditing. Enforce separation of duties between MSK admins and KMS key custodians, and regularly review access, aliases, and pending-deletion states.

​
Remediation

# MSK cluster using a customer managed KMS key for encryption at rest
resource "aws_msk_cluster" "<example_resource_name>" {
  cluster_name           = "<example_resource_name>"
  kafka_version          = "<KAFKA_VERSION>"
  number_of_broker_nodes = 2

  broker_node_group_info {
    instance_type  = "kafka.m5.large"
    client_subnets = ["<example_subnet_id_a>", "<example_subnet_id_b>"]
    security_groups = ["<example_security_group_id>"]
  }

  encryption_info {
    encryption_at_rest_kms_key_arn = "<example_kms_key_arn>" # Critical: customer managed KMS key to pass the check
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kafka_cluster_encryption_at_rest_uses_cmk. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks