Amazon MSK cluster has enhanced monitoring enabled

Check ID: kafka_cluster_enhanced_monitoring_enabled
Provider: AWS
Service: kafka
Severity: MEDIUM
Categories: logging
Resource type: AwsMskCluster

What this check verifies

Amazon MSK clusters are assessed for enhanced monitoring levels beyond DEFAULT (e.g., PER_BROKER, PER_TOPIC_PER_BROKER, PER_TOPIC_PER_PARTITION). Serverless clusters include enhanced monitoring by design; provisioned clusters are evaluated by their configured monitoring level.

Risk

Insufficient metrics limit visibility into broker health, replication state, and consumer lag, delaying response to incidents. This increases risk of availability loss (saturation, throttling) and can mask integrity issues such as under-replicated partitions, raising data-loss impact during failures.

Recommendation

Select an enhanced level (e.g., PER_BROKER or finer) and establish observability: prioritize telemetry for broker resources, replication health, and consumer lag. Configure alerts and dashboards aligned to SLOs to enable proactive scaling and rapid incident containment. Balance granularity with cost.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws kafka update-monitoring —cluster-arn <CLUSTER_ARN> —current-version <CURRENT_VERSION> —enhanced-monitoring PER_BROKER

# Terraform: Enable enhanced monitoring on an MSK cluster
resource "aws_msk_cluster" "<example_resource_name>" {
  cluster_name           = "<example_resource_name>"
  kafka_version          = "<example_kafka_version>"
  number_of_broker_nodes = 2

  broker_node_group_info {
    instance_type  = "kafka.t3.small"
    client_subnets = ["<example_subnet_id_1>", "<example_subnet_id_2>"]
  }

  enhanced_monitoring = "PER_BROKER" # Critical: sets monitoring above DEFAULT to pass the check
}

# CloudFormation: Enable enhanced monitoring on an MSK cluster
Resources:
  <example_resource_name>:
    Type: AWS::MSK::Cluster
    Properties:
      ClusterName: <example_resource_name>
      KafkaVersion: <example_kafka_version>
      NumberOfBrokerNodes: 2
      BrokerNodeGroupInfo:
        ClientSubnets:
          - <example_subnet_id_1>
          - <example_subnet_id_2>
        InstanceType: kafka.t3.small
      EnhancedMonitoring: PER_BROKER  # Critical: sets enhanced monitoring above DEFAULT to pass the check

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kafka_cluster_enhanced_monitoring_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Kafka cluster encrypts data at rest with a customer key Kafka cluster has encryption in transit enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires