Kafka cluster requires authentication

Check ID: kafka_cluster_unrestricted_access_disabled
Provider: AWS
Service: kafka
Severity: CRITICAL
Categories: identity-access
Resource type: AwsMskCluster

What this check verifies

Amazon MSK clusters are evaluated for unauthenticated client access. Serverless clusters inherently require authentication; provisioned clusters are checked for configurations that allow unrestricted connections rather than authenticated clients.

Risk

Allowing unauthenticated access lets anyone connect and:

Read sensitive topics (confidentiality)
Publish or alter data (integrity)
Overload brokers and consumers (availability)

This enables message exfiltration, stream poisoning, and abuse of trusted data pipelines.

Recommendation

Disable unauthenticated access and require strong client authentication (mTLS or IAM/SASL).

Enforce least privilege with scoped ACLs
Restrict network paths via private connectivity and tight security groups
Encrypt in transit, monitor access, and rotate credentials regularly

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws kafka update-security --cluster-arn <example_resource_arn> --current-version <example_current_version> --client-authentication 'Unauthenticated={Enabled=false}'

# Terraform: Disable unauthenticated client access for MSK
resource "aws_msk_cluster" "<example_resource_name>" {
  cluster_name           = "<example_resource_name>"
  kafka_version          = "<example_kafka_version>"
  number_of_broker_nodes = 2

  broker_node_group_info {
    instance_type   = "<example_instance_type>"
    client_subnets  = ["<subnet_id_1>", "<subnet_id_2>"]
    ebs_volume_size = 1000
  }

  client_authentication {
    unauthenticated = false  # CRITICAL: Disables unauthenticated client access
  }
}

# CloudFormation: Disable unauthenticated client access for MSK
Resources:
  <example_resource_name>:
    Type: AWS::MSK::Cluster
    Properties:
      ClusterName: <example_resource_name>
      KafkaVersion: <example_kafka_version>
      NumberOfBrokerNodes: 2
      BrokerNodeGroupInfo:
        InstanceType: <example_instance_type>
        ClientSubnets:
          - <subnet_id_1>
          - <subnet_id_2>
        StorageInfo:
          EbsStorageInfo:
            VolumeSize: 1000
      ClientAuthentication:
        Unauthenticated:
          Enabled: false  # CRITICAL: Disables unauthenticated client access

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kafka_cluster_unrestricted_access_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Kafka cluster has TLS authentication enabled MSK cluster uses the latest Kafka version or is serverless

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires