Amazon MSK controls
These controls are related to Amazon Managed Streaming for Apache Kafka (Amazon MSK) resources.
These controls may not be available in all Amazon Web Services Regions. For more information, see Availability of controls by Region.
[MSK.1] MSK clusters should be encrypted in transit among broker nodes
Related requirements: NIST.800-53.r5 AC-4, NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2)
Category: Protect > Data Protection > Encryption of data-in-transit
Severity: Medium
Resource type:
AWS::MSK::Cluster
Amazon Config rule:
msk-in-cluster-node-require-tls
Schedule type: Change triggered
Parameters: None
This controls checks whether an Amazon MSK cluster is encrypted in transit with HTTPS (TLS) among the broker nodes of the cluster. The control fails if plain text communication is enabled for a cluster broker node connection.
HTTPS offers an extra layer of security as it uses TLS to move data and can be used to help prevent potential attackers from using person-in-the-middle or similar attacks to eavesdrop on or manipulate network traffic. By default, Amazon MSK encrypts data in transit with TLS. However, you can override this default at the time that you create the cluster. We recommend using encrypted connections over HTTPS (TLS) for-broker node connections.
Remediation
To update encryption settings for MSK clusters, see Updating security settings of a cluster in the Amazon Managed Streaming for Apache Kafka Developer Guide.
[MSK.2] MSK clusters should have enhanced monitoring configured
Related requirements: NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2
Category: Detect > Detection services
Severity: Low
Resource type:
AWS::MSK::Cluster
Amazon Config rule:
msk-enhanced-monitoring-enabled
Schedule type: Change triggered
Parameters: None
This control checks whether an Amazon MSK cluster has enhanced monitoring configured, specified by a monitoring level of
at least PER_TOPIC_PER_BROKER. The control fails if the monitoring level for the cluster is set to
DEFAULT or PER_BROKER.
The PER_TOPIC_PER_BROKER monitoring level provides more granular insights into the performance of your
MSK cluster, and also provides metrics related to resource utilization, such as CPU and memory usage. This helps you identify
performance bottlenecks and resource utilization patterns for individual topics and brokers. This visibility, in turn, can optimize
the performance of your Kafka brokers.
Remediation
To configure enhanced monitoring for an MSK cluster, complete the following steps:
Open the Amazon MSK console at https://console.amazonaws.cn/msk/home?region=us-east-1#/home/
. In the navigation pane, choose Clusters. Then, choose a cluster.
For Action, select Edit monitoring.
Select the option for Enhanced topic-level monitoring.
Choose Save changes.
For more information about monitoring levels, see Updating security settings of a cluster in the Amazon Managed Streaming for Apache Kafka Developer Guide.