Check ID: mq_broker_not_publicly_accessible
Provider: AWS
Service: mq
Severity: HIGH
Categories: internet-exposed
Resource type: AwsAmazonMQBroker

​
What this check verifies

Amazon MQ brokers are evaluated for public accessibility, determining whether a broker exposes a public endpoint or is restricted to VPC-only connectivity via its publicly accessible setting.

​
Risk

Publicly reachable brokers expand exposure: internet hosts can probe protocols and consoles, attempt credential spraying, publish/consume messages, and flood connections. This threatens confidentiality (data leakage), integrity (message tampering), and availability (DoS/resource exhaustion).

​
Recommendation

Prefer private deployment: set publicly_accessible=false, place brokers in private subnets, and restrict security groups to trusted producers/consumers. Use private connectivity (VPC endpoints, peering, VPN/Direct Connect). Enforce strong authn and authorization maps, and allow only required protocol ports. Apply least privilege.

​
Remediation

# Amazon MQ broker without public accessibility
resource "aws_mq_broker" "<example_resource_name>" {
  broker_name         = "<example_resource_name>"
  engine_type         = "ActiveMQ"
  engine_version      = "<example_engine_version>"
  host_instance_type  = "<example_instance_type>"
  publicly_accessible = false # Critical: disables public internet access
  security_groups     = ["<example_security_group_id>"]
  subnet_ids          = ["<example_subnet_id>"]

  user {
    username = "<example_username>"
    password = "<example_password>"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = mq_broker_not_publicly_accessible. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks