MSK clusters should disable unauthenticated access

How to fix it

• Can break clients: Clients that connect without credentials or over plaintext are refused once this applies, so move each one to the new method and its bootstrap addresses first.
• Affects another check: A cluster without in-cluster encryption cannot turn on IAM, SASL/SCRAM or mutual TLS, so it must be replaced by one that has it, which MSK.1 asks for, before this can pass.

In the console

Managed Streaming for Apache Kafka → Clusters → the cluster → Properties → Security settings → Edit

Unauthenticated access

Off

Access control methods

IAM access control, SASL/SCRAM or mutual TLS: at least one, matching what your clients can use

Between clients and brokers

TLS encryption only (ClientBroker TLS); SASL with TLS_PLAINTEXT requires unauthenticated access on

With the AWS CLI

aws kafka update-security --cluster-arn <cluster-arn> --current-version <current-version> --client-authentication '{"Sasl":{"Iam":{"Enabled":true}},"Unauthenticated":{"Enabled":false}}' --encryption-info '{"EncryptionInTransit":{"ClientBroker":"TLS"}}' --region <region>

With Terraform

resource "aws_msk_cluster" "this" {
  cluster_name           = var.cluster_name
  kafka_version          = var.kafka_version
  number_of_broker_nodes = var.number_of_broker_nodes

  broker_node_group_info {
    client_subnets  = var.client_subnets
    instance_type   = var.instance_type
    security_groups = var.security_groups
  }

  client_authentication {
    unauthenticated = false

    sasl {
      iam = true
    }
  }

  encryption_info {
    encryption_in_transit {
      client_broker = "TLS"
    }
  }
}