Kafka cluster is not publicly accessible

Check ID: kafka_cluster_is_public
Provider: AWS
Service: kafka
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsMskCluster

What this check verifies

Amazon MSK clusters with broker endpoints exposed to the public Internet. Serverless clusters are private by default; provisioned clusters are evaluated for their public access configuration.

Risk

Public brokers erode CIA:

Confidentiality: unauthorized consumers can read topics
Integrity: rogue producers inject or alter events
Availability: floods or scans strain brokers

This enables metadata enumeration, data exfiltration, stream poisoning, and costly egress.

Recommendation

Keep brokers private within the VPC by disabling public access and limiting exposure to trusted networks. Enforce strong auth (SASL/IAM, SASL/SCRAM, or mTLS), require TLS, and apply Kafka ACLs. Provide access via VPN, bastion, or private networking (peering/Transit Gateway). Apply least privilege and monitor broker connections.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws kafka update-connectivity --cluster-arn <CLUSTER_ARN> --current-version <CURRENT_CLUSTER_VERSION> --connectivity-info '{"PublicAccess":{"Type":"DISABLED"}}'

# Terraform: ensure MSK cluster is not publicly accessible
resource "aws_msk_cluster" "<example_resource_name>" {
  cluster_name           = "<example_resource_name>"
  kafka_version          = "2.8.1"
  number_of_broker_nodes = 2

  broker_node_group_info {
    client_subnets = [
      "<example_subnet_id_1>",
      "<example_subnet_id_2>",
    ]
    instance_type = "kafka.t3.small"

    connectivity_info {
      public_access {
        type = "DISABLED"  # Critical: disables public access to brokers
      }
    }
  }
}

# CloudFormation: ensure MSK cluster is not publicly accessible
Resources:
  <example_resource_name>:
    Type: AWS::MSK::Cluster
    Properties:
      ClusterName: <example_resource_name>
      KafkaVersion: "2.8.1"
      NumberOfBrokerNodes: 2
      BrokerNodeGroupInfo:
        ClientSubnets:
          - <example_subnet_id_1>
          - <example_subnet_id_2>
        InstanceType: kafka.t3.small
        ConnectivityInfo:
          PublicAccess:
            Type: DISABLED  # Critical: disables public access to brokers

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kafka_cluster_is_public. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Kafka cluster has encryption in transit enabled Kafka cluster has TLS authentication enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires