A MSK cluster allows unencrypted data at rest.
Encryption should be forced for Kafka clusters, including at rest. This ensures sensitive data is kept private.
Impact
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
Enable at rest encryption
1
2
3
4
5
6
7
|
Resources:
GoodCluster:
Type: AWS::MSK::Cluster
Properties:
EncryptionInfo:
EncryptionAtRest:
DataVolumeKMSKeyId: foo-bar-key
|
Enable at rest encryption
1
2
3
4
5
|
resource "aws_msk_cluster" "good_example" {
encryption_info {
encryption_at_rest_kms_key_arn = "foo-bar-key"
}
}
|
Links