MSK clusters should be encrypted in transit among broker nodes

How to fix it

• Replaces the resource: In-cluster encryption is fixed when a cluster is created: create a new cluster with it on, replicate the topics to it, repoint clients, then delete this one.
• Affects another check: Without in-cluster encryption a cluster can allow only unauthenticated clients, so turn on IAM, SASL/SCRAM or mutual TLS authentication on the new cluster too, which MSK.6 asks for.

In the console

Managed Streaming for Apache Kafka → Clusters → Create cluster → Custom create → Security settings

Within the cluster

TLS encryption on (AWS's default, InCluster true)

Between clients and brokers

TLS encryption only (ClientBroker TLS), which IAM, SASL/SCRAM and mutual TLS authentication need

With the AWS CLI

aws kafka create-cluster --cluster-name <new-cluster-name> --kafka-version <kafka-version> --number-of-broker-nodes <number-of-broker-nodes> --broker-node-group-info <broker-node-group-info-json> --encryption-info '{"EncryptionInTransit":{"InCluster":true,"ClientBroker":"TLS"}}' --region <region>

With Terraform

• Interrupts service: In Terraform in_cluster forces a new cluster, so setting it on this cluster's block destroys the cluster and its topics; declare the new cluster as its own block.

resource "aws_msk_cluster" "encrypted" {
  cluster_name           = var.new_cluster_name
  kafka_version          = var.kafka_version
  number_of_broker_nodes = var.number_of_broker_nodes

  broker_node_group_info {
    client_subnets  = var.client_subnets
    instance_type   = var.instance_type
    security_groups = var.security_groups
  }

  encryption_info {
    encryption_in_transit {
      in_cluster    = true
      client_broker = "TLS"
    }
  }
}