MSK clusters should have enhanced monitoring configured
Flags MSK clusters that send CloudWatch metrics at the DEFAULT or PER_BROKER level rather than PER_TOPIC_PER_BROKER or finer. Topic-level metrics show which topics and brokers drive load and resource use, so bottlenecks and unusual traffic can be found before they cause an outage.
- service
- MSK
- severity
- Low
- scope
- evaluated in every region
How to fix it
In the console
Managed Streaming for Apache Kafka → Clusters → the cluster → Actions → Edit monitoring
- Enhanced topic-level monitoring
- Selected (PER_TOPIC_PER_BROKER); partition-level (PER_TOPIC_PER_PARTITION) passes too
With the AWS CLI
aws kafka update-monitoring --cluster-arn <cluster-arn> --current-version <current-version> --enhanced-monitoring PER_TOPIC_PER_BROKER --region <region>With Terraform
resource "aws_msk_cluster" "this" {
cluster_name = var.cluster_name
kafka_version = var.kafka_version
number_of_broker_nodes = var.number_of_broker_nodes
enhanced_monitoring = "PER_TOPIC_PER_BROKER"
broker_node_group_info {
client_subnets = var.client_subnets
instance_type = var.instance_type
security_groups = var.security_groups
}
}
See which of your accounts this check is failing on.
Book a live scan