MSK Connect connectors should be encrypted in transit

How to fix it

• Replaces the resource: Encryption is fixed when a connector is created: create a new connector with TLS from the same plugin and configuration, confirm it is running, then delete this one.
• Affects another check: Log delivery is also fixed at creation, so turn it on in the new connector as well, which MSK.5 asks for.

In the console

Managed Streaming for Apache Kafka → MSK Connect → Connectors → Create connector

Encryption in transit

TLS encryption

Apache Kafka cluster

One whose client-broker encryption allows TLS; a PLAINTEXT-only cluster cannot take a TLS connector

With the AWS CLI

aws kafkaconnect create-connector --connector-name <new-connector-name> --kafka-connect-version <kafka-connect-version> --capacity <capacity-json> --connector-configuration <connector-configuration-json> --kafka-cluster <kafka-cluster-json> --kafka-cluster-client-authentication authenticationType=<authentication-type> --kafka-cluster-encryption-in-transit encryptionType=TLS --plugins <plugins-json> --service-execution-role-arn <service-execution-role-arn> --region <region>

With Terraform

• Interrupts service: In Terraform kafka_cluster_encryption_in_transit forces a new connector, so changing it on this connector's block deletes the connector before its replacement runs.

resource "aws_mskconnect_connector" "this" {
  name                       = var.new_connector_name
  kafkaconnect_version       = var.kafkaconnect_version
  connector_configuration    = var.connector_configuration
  service_execution_role_arn = var.service_execution_role_arn

  capacity {
    provisioned_capacity {
      worker_count = var.worker_count
    }
  }

  kafka_cluster {
    apache_kafka_cluster {
      bootstrap_servers = var.bootstrap_servers_tls

      vpc {
        security_groups = var.security_groups
        subnets         = var.subnets
      }
    }
  }

  kafka_cluster_client_authentication {
    authentication_type = var.authentication_type
  }

  kafka_cluster_encryption_in_transit {
    encryption_type = "TLS"
  }

  plugin {
    custom_plugin {
      arn      = var.custom_plugin_arn
      revision = var.custom_plugin_revision
    }
  }
}