Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

MSK cluster should deliver broker logs to CloudWatch, S3, or Firehose

AWS_MSK_004 MEDIUM Observability

What it checks

MSK cluster should deliver broker logs to CloudWatch, S3, or Firehose

Where it applies

Terraform: aws_msk_cluster

CloudFormation: AWS::MSK::Cluster

How to fix it

  1. Add a logging_info.broker_logs block with at least one destination (cloudwatch_logs, firehose, or s3) set enabled = true. Create the destination resource first — MSK does not create it for you.

Frameworks

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules