AWS Security Hub · MSK
MSK.1: MSK should encrypt in transit among broker nodes
Written and reviewed by Emnode · Last reviewed
What does AWS Security Hub MSK.1 check?
MSK.1 fails when a cluster's EncryptionInTransit configuration does not encrypt broker-to-broker traffic: the InCluster flag is false. This is distinct from the ClientBroker setting that most people think of as 'MSK encryption'.
Why does MSK.1 matter?
The in-cluster setting protects the traffic brokers exchange among themselves as they replicate partitions. With it off, that internal replication crosses the network in plaintext, observable to anyone with a foothold on the VPC network. MSK encrypts this by default, so a disabled in-cluster setting almost always means an IaC override turned it off explicitly.
How do I fix MSK.1?
- Read the cluster's EncryptionInTransit to check the InCluster flag.
- Because the setting is fixed at creation and cannot be toggled on a running cluster, plan a migration to a new cluster with in-cluster encryption on.
- Mirror topics and consumer offsets to the new cluster and cut producers and consumers over.
- Audit IaC for any encryption_in_transit block that disables in-cluster encryption.
Remediation script · bash
# Find the highest-impact plaintext-permitting stores across engines.
aws rds describe-db-instances \
--query 'DBInstances[].DBInstanceIdentifier' --output text
aws elasticache describe-replication-groups \
--query 'ReplicationGroups[?TransitEncryptionEnabled==`false`].ReplicationGroupId' \
--output text
# RDS for PostgreSQL: require TLS via rds.force_ssl (static -> needs a reboot).
PG=$(aws rds describe-db-instances --db-instance-identifier prod-orders-pg \
--query 'DBInstances[].DBParameterGroups[].DBParameterGroupName' --output text)
aws rds modify-db-parameter-group --db-parameter-group-name "$PG" \
--parameters 'ParameterName=rds.force_ssl,ParameterValue=1,ApplyMethod=pending-reboot'
aws rds reboot-db-instance --db-instance-identifier prod-orders-pg
# Redshift: require_ssl on a custom cluster parameter group, then reboot.
aws redshift modify-cluster-parameter-group --parameter-group-name analytics-tls \
--parameters ParameterName=require_ssl,ParameterValue=true
aws redshift reboot-cluster --cluster-identifier analytics-prodFull walkthrough (console steps, edge cases and verification) in the lesson Enforce TLS on database and cache connections.
Is MSK.1 a false positive?
Teams assume MSK's default-on encryption covers this, but a Terraform block setting client_broker to TLS_PLAINTEXT for a migration can silently leave in_cluster off, and unlike ClientBroker, it cannot be fixed in place.