Amazon MQ broker should not be publicly accessible

What it checks

Amazon MQ broker should not be publicly accessible

Where it applies

Terraform: aws_mq_broker

CloudFormation: AWS::AmazonMQ::Broker

How to fix it

1. Set publicly_accessible = false so the broker is reachable only from within the VPC (via a VPN, Direct Connect, or in-VPC clients). publicly_accessible is set at creation, so an existing public broker must be recreated.

Frameworks

• NIST 800-53 rev5 SC-7
• SOC 2 CC6.6

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules