Amazon MSK clusters should have public access disabled

How to fix it

• Can break clients: The public bootstrap addresses are withdrawn with no redirect to the private ones, so move clients into the VPC, or onto a VPN connection, Direct Connect or VPC peering, first.

In the console

Managed Streaming for Apache Kafka → Clusters → the cluster → Properties → Network settings → Edit public access

Public access

Off

With the AWS CLI

aws kafka update-connectivity --cluster-arn <cluster-arn> --current-version <current-version> --connectivity-info '{"PublicAccess":{"Type":"DISABLED"}}' --region <region>

With Terraform

resource "aws_msk_cluster" "this" {
  cluster_name           = var.cluster_name
  kafka_version          = var.kafka_version
  number_of_broker_nodes = var.number_of_broker_nodes

  broker_node_group_info {
    client_subnets  = var.client_subnets
    instance_type   = var.instance_type
    security_groups = var.security_groups

    connectivity_info {
      public_access {
        type = "DISABLED"
      }
    }
  }
}