Amazon Managed Streaming for Apache Kafka (MSK) is a fully managed service that makes it easy to build and run applications that use Apache Kafka to process streaming data. To ensure the security of MSK clusters, it is important to ensure that the Kafka broker instances are not publicly accessible. By default, MSK broker instances are launched within a private subnet of a Virtual Private Cloud (VPC), which provides network isolation and improved security. However, if the MSK cluster is not configured properly, it is possible that broker instances may be publicly accessible, which can result in potential security risks such as unauthorized access, data breaches, and resource hijacking. Ensuring that MSK broker instances are not publicly accessible helps to improve the security of MSK clusters and prevent unauthorized access to Kafka data and resources.
The following are the remediation steps to ensure that MSK broker instances are not publicly accessible:
- Log in to the AWS Management Console and navigate to the Amazon MSK dashboard.
- Select the MSK cluster for which you want to check the broker instance accessibility.
- Navigate to the "Broker" tab in the MSK cluster details page.
- Check the accessibility column of each broker instance.
- If any broker instance is accessible publicly, select the broker instance and click the "Actions" button.
- In the dropdown menu, select "Modify broker instance."
- In the "Modify broker instance" page, scroll down to the "Networking" section.
- Change the "Subnet" field to a private subnet that is not publicly accessible.
- Scroll down to the bottom of the page and click the "Modify" button.
- Repeat steps 5-9 for each publicly accessible broker instance.
- After updating the subnet of all publicly accessible broker instances, verify that none of the broker instances are publicly accessible.
By following these steps, you can ensure that MSK broker instances are not publicly accessible, helping to improve the security of Kafka clusters and prevent unauthorized access to Kafka data and resources.
Note: Remediation steps provided by Lightlytics are meant to be suggestions and guidelines only. It is crucial to thoroughly verify and test any remediation steps before applying them to production environments. Each organization's infrastructure and security needs may differ, and blindly applying suggested remediation steps without proper testing could potentially cause unforeseen issues or vulnerabilities. Therefore, it is strongly recommended that you validate and customize any remediation steps to meet your organization's specific requirements and ensure that they align with your security policies and best practices.
