MSK cluster should not have public access enabled

What it checks

MSK cluster: public broker access is configured.

Where it applies

Terraform: aws_msk_cluster

CloudFormation: AWS::MSK::Cluster

How to fix it

1. Set connectivity_info.public_access.type = "DISABLED" so brokers are reachable only from within the VPC. Access Kafka from in-VPC clients, a VPN, or Direct Connect.

Frameworks

• NIST 800-53 rev5 SC-7
• SOC 2 CC6.6
• HIPAA 164.312(e)(1)
• AWS FSBP MSK.4

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules