MSK cluster should enforce TLS encryption for client-to-broker connections

What it checks

MSK cluster: client-to-broker encryption allows plaintext connections.

Where it applies

Terraform: aws_msk_cluster

CloudFormation: AWS::MSK::Cluster

How to fix it

1. Set encryption_info.encryption_in_transit.client_broker = "TLS". Update Kafka client configurations to use TLS connection strings.

Frameworks

• SOC 2 CC6.7
• HIPAA 164.312(e)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules