MSK cluster uses the latest Kafka version or is serverless

Check ID: kafka_cluster_uses_latest_version
Provider: AWS
Service: kafka
Severity: MEDIUM
Categories: vulnerabilities
Resource type: AwsMskCluster

What this check verifies

Amazon MSK clusters are evaluated for use of the latest supported Apache Kafka version. Provisioned clusters are compared to the most recent release, while serverless clusters are treated as automatically managed for versioning.

Risk

Outdated Kafka enables exploitation of known flaws and weak cryptography, risking data exposure or tampering (confidentiality/integrity). Missing fixes increase broker crashes and partition instability (availability). After end of support, silent auto-upgrades can trigger unexpected behavior and compatibility issues.

Recommendation

Adopt a controlled upgrade strategy:

Track MSK version support and upgrade before end of support
Test in staging and schedule maintenance windows
Use blue/green or rolling upgrades to reduce downtime
Validate client compatibility and security settings
Consider serverless MSK if automatic versioning fits your risk model

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws kafka update-cluster-kafka-version —cluster-arn <example_resource_id> —current-version <current_version> —target-kafka-version <latest_version>

# Terraform: Upgrade MSK cluster to latest Kafka version
resource "aws_msk_cluster" "<example_resource_name>" {
  cluster_name           = "<example_resource_name>"
  kafka_version          = "<latest_version>"  # CRITICAL: set to the latest Kafka version to pass the check
  number_of_broker_nodes = 2

  broker_node_group_info {
    instance_type  = "kafka.m5.large"
    client_subnets = ["<example_resource_id>", "<example_resource_id>"]

    storage_info {
      ebs_storage_info { volume_size = 1000 }
    }
  }
}

# CloudFormation: Upgrade MSK cluster to latest Kafka version
Resources:
  <example_resource_name>:
    Type: AWS::MSK::Cluster
    Properties:
      ClusterName: <example_resource_name>
      KafkaVersion: <latest_version>  # CRITICAL: set to the latest Kafka version to pass the check
      NumberOfBrokerNodes: 2
      BrokerNodeGroupInfo:
        InstanceType: kafka.m5.large
        ClientSubnets:
          - <example_resource_id>
          - <example_resource_id>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kafka_cluster_uses_latest_version. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Kafka cluster requires authentication MSK Connect connector has encryption in transit enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires