Check ID: kafka_connector_in_transit_encryption_enabled
Provider: AWS
Service: kafka
Severity: HIGH
Categories: encryption
Resource type: Other

​
What this check verifies

MSK Connect connectors are evaluated for in-transit encryption using TLS on client connections to Kafka brokers and connected systems.

​
Risk

Without TLS, data streams can be intercepted or modified in transit. Attackers on the path can perform man-in-the-middle, replay, or message tampering, exposing records and secrets. This degrades confidentiality and integrity and can enable unauthorized access to downstream systems.

​
Recommendation

Require TLS for all connector communications and disallow plaintext. Prefer private connectivity, validate certificates, and use modern cipher suites. Pair with mutual authentication and least privilege roles for defense-in-depth. Regularly review connector configs to avoid non-TLS endpoints.

​
Remediation

# Terraform: MSK Connect connector with in-transit encryption enabled
resource "aws_mskconnect_connector" "<example_resource_name>" {
  name                  = "<example_resource_name>"
  kafkaconnect_version  = "<KAFKA_CONNECT_VERSION>"

  kafka_cluster {
    apache_kafka_cluster {
      bootstrap_servers = "<BOOTSTRAP_SERVERS>"
      vpc {
        security_groups = ["<example_resource_id>"]
        subnets         = ["<example_resource_id>"]
      }
    }
  }

  kafka_cluster_client_authentication {
    authentication_type = "NONE"
  }

  kafka_cluster_encryption_in_transit {
    encryption_type = "TLS"  # Critical: enables TLS encryption in transit
  }

  capacity {
    provisioned_capacity {
      mcu_count    = 1
      worker_count = 1
    }
  }

  service_execution_role_arn = "<example_resource_id>"

  connector_configuration = {
    "connector.class" = "<CONNECTOR_CLASS>"
    "tasks.max"       = "1"
  }

  plugin {
    custom_plugin {
      arn      = "<example_resource_id>"
      revision = 1
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = kafka_connector_in_transit_encryption_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks