MSK clusters should be encrypted in transit among broker nodes

Description

This control checks whether an Amazon Managed Streaming for Apache Kafka (MSK) cluster is configured to encrypt data in transit using HTTPS (TLS) between its broker nodes. The control will fail if plain text communication is enabled for any cluster broker node connection. HTTPS, by utilizing TLS, provides an additional layer of security. This helps protect against 'person-in-the-middle' attacks and similar threats that could lead to eavesdropping or manipulation of network traffic. While Amazon MSK encrypts data in transit with TLS by default, this default can be overridden during cluster creation. The recommendation is to always use encrypted connections over HTTPS (TLS) for broker node communications.

---

Remediation

To remediate MSK clusters without encryption in transit between broker nodes, you need to enable TLS encryption for in-cluster communication.

Steps