Kafka cluster has TLS authentication enabled

Check ID: kafka_cluster_mutual_tls_authentication_enabled
Provider: AWS
Service: kafka
Severity: HIGH
Categories: encryption
Resource type: AwsMskCluster

What this check verifies

Amazon MSK clusters enforce client authentication on client-to-broker connections. Serverless clusters use TLS-based authentication by default; provisioned clusters must have mutual TLS (mTLS) explicitly enabled.

Risk

Without mTLS, adversaries can impersonate clients or intercept sessions, compromising confidentiality and integrity. Unauthorized producers/consumers can read or alter topics, poison data streams, and flood brokers, degrading availability and impacting downstream systems.

Recommendation

Enable mutual TLS for client-broker traffic and disable PLAINTEXT listeners. Issue short-lived client certificates from a managed CA with rotation. Apply least privilege using Kafka ACLs, restrict network access to trusted sources, and monitor authentication events as part of defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws kafka update-security --cluster-arn <CLUSTER_ARN> --current-version <CURRENT_VERSION> --client-authentication 'Tls={CertificateAuthorityArnList=["<ACM_PCA_ARN>"]}' --encryption-info 'EncryptionInTransit={ClientBroker=TLS}'

# Terraform: Enable mTLS for an MSK cluster
resource "aws_msk_cluster" "<example_resource_name>" {
  cluster_name           = "<example_resource_name>"
  kafka_version          = "<example_kafka_version>"
  number_of_broker_nodes = 2

  broker_node_group_info {
    instance_type  = "kafka.m5.large"
    client_subnets = ["<subnet_id_1>", "<subnet_id_2>"]
  }

  client_authentication {
    tls {
      certificate_authority_arns = ["<acm_pca_arn>"]  # CRITICAL: Enables mutual TLS with this Private CA
    }
  }

  encryption_info {
    encryption_in_transit {
      client_broker = "TLS"  # CRITICAL: Required when enabling mTLS
    }
  }
}

# CloudFormation: Enable mTLS for an MSK cluster
Resources:
  <example_resource_name>:
    Type: AWS::MSK::Cluster
    Properties:
      ClusterName: <example_resource_name>
      KafkaVersion: <example_kafka_version>
      NumberOfBrokerNodes: 2
      BrokerNodeGroupInfo:
        InstanceType: kafka.m5.large
        ClientSubnets:
          - <subnet_id_1>
          - <subnet_id_2>
      ClientAuthentication:
        Tls:
          CertificateAuthorityArnList:
            - <acm_pca_arn>  # CRITICAL: Enables mutual TLS using this Private CA
      EncryptionInfo:
        EncryptionInTransit:
          ClientBroker: TLS  # CRITICAL: Required when enabling mTLS

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kafka_cluster_mutual_tls_authentication_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Kafka cluster is not publicly accessible Kafka cluster requires authentication

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires