Check ID: kafka_cluster_in_transit_encryption_enabled
Provider: AWS
Service: kafka
Severity: HIGH
Categories: encryption
Resource type: AwsMskCluster

​
What this check verifies

Amazon MSK clusters are evaluated for encryption in transit on both paths: clientbroker set to TLS only and inter-broker encryption enabled. Serverless clusters provide this by default. The finding highlights clusters where client-broker traffic isn’t TLS-only or inter-broker encryption is turned off.

​
Risk

Unencrypted or mixed (TLS_PLAINTEXT/PLAINTEXT) traffic enables interception of records, credentials, and metadata, supporting MITM, replay, and message tampering. Plaintext inter-broker links expose replication data within the VPC, enabling lateral movement and topic poisoning, degrading data confidentiality and integrity.

​
Recommendation

Enforce end-to-end transport protection:
  • Require client_broker=TLS for all clients
  • Enable in_cluster=true for broker-to-broker links
Apply defense in depth: restrict network paths, prefer private connectivity, and use strong client authentication with least privilege authorization to limit blast radius.

​
Remediation

# Terraform: MSK cluster with encryption in transit enforced
resource "aws_msk_cluster" "<example_resource_name>" {
  cluster_name           = "<example_resource_name>"
  kafka_version          = "<VERSION>"
  number_of_broker_nodes = 3

  broker_node_group_info {
    instance_type  = "kafka.m5.large"
    client_subnets = [
      "subnet-<example_resource_id>",
      "subnet-<example_resource_id>",
    ]
  }

  encryption_info {
    encryption_in_transit {
      client_broker = "TLS"  # Critical: forces client-to-broker TLS only
      in_cluster    = true    # Critical: enables inter-broker encryption
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kafka_cluster_in_transit_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks