Amazon MSK controls - AWS Security Hub

Amazon MSK controls

These controls are related to Amazon Managed Streaming for Apache Kafka (Amazon MSK) resources.

These controls may not be available in all AWS Regions. For more information, see Availability of controls by Region.

[MSK.1] MSK clusters should be encrypted in transit among broker nodes

Related requirements: NIST.800-53.r5 AC-4, NIST.800-53.r5 SC-13, NIST.800-53.r5 SC-23, NIST.800-53.r5 SC-23(3), NIST.800-53.r5 SC-7(4), NIST.800-53.r5 SC-8, NIST.800-53.r5 SC-8(1), NIST.800-53.r5 SC-8(2)

Category: Protect > Data protection > Encryption of data-in-transit

Severity: Medium

Resource type: AWS::MSK::Cluster

AWS Config rule: msk-in-cluster-node-require-tls

Schedule type: Change triggered

Parameters: None

This controls checks if an Amazon MSK cluster is encrypted in transit with HTTPS (TLS) among the broker nodes of the cluster. The control fails if plain text communication is enabled for a cluster broker node connection.

HTTPS offers an extra layer of security as it uses TLS to move data and can be used to help prevent potential attackers from using person-in-the-middle or similar attacks to eavesdrop on or manipulate network traffic. By default, Amazon MSK encrypts data in transit with TLS. However, you can override this default at the time that you create the cluster. We recommend using encrypted connections over HTTPS (TLS) for-broker node connections.

Remediation

To update encryption settings for MSK clusters, see Updating security settings of a cluster in the Amazon Managed Streaming for Apache Kafka Developer Guide.

[MSK.2] MSK clusters should have enhanced monitoring configured

Related requirements: NIST.800-53.r5 CA-7, NIST.800-53.r5 SI-2

Category: Detect > Detection services

Severity: Low

Resource type: AWS::MSK::Cluster

AWS Config rule: msk-enhanced-monitoring-enabled

Schedule type: Change triggered

Parameters: None

This control checks whether an Amazon MSK cluster has enhanced monitoring configured, specified by a monitoring level of at least PER_TOPIC_PER_BROKER. The control fails if the monitoring level for the cluster is set to DEFAULT or PER_BROKER.

The PER_TOPIC_PER_BROKER monitoring level provides more granular insights into the performance of your MSK cluster, and also provides metrics related to resource utilization, such as CPU and memory usage. This helps you identify performance bottlenecks and resource utilization patterns for individual topics and brokers. This visibility, in turn, can optimize the performance of your Kafka brokers.

Remediation

To configure enhanced monitoring for an MSK cluster, complete the following steps:

  1. Open the Amazon MSK console at https://console.aws.amazon.com/msk/home?region=us-east-1#/home/.

  2. In the navigation pane, choose Clusters. Then, choose a cluster.

  3. For Action, select Edit monitoring.

  4. Select the option for Enhanced topic-level monitoring.

  5. Choose Save changes.

For more information about monitoring levels, see Updating security settings of a cluster in the Amazon Managed Streaming for Apache Kafka Developer Guide.