Back to Checks
aws

Amazon MSK cluster has enhanced monitoring enabled

kafka_cluster_enhanced_monitoring_enabled
Service: kafkaSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsMskCluster

Amazon MSK clusters are assessed for enhanced monitoring levels beyond DEFAULT (e.g., PER_BROKER, PER_TOPIC_PER_BROKER, PER_TOPIC_PER_PARTITION).

Serverless clusters include enhanced monitoring by design; provisioned clusters are evaluated by their configured monitoring level.

Prowler logoProwlerprowler-provider-aws

Risk

Insufficient metrics limit visibility into broker health, replication state, and consumer lag, delaying response to incidents.

This increases risk of availability loss (saturation, throttling) and can mask integrity issues such as under-replicated partitions, raising data-loss impact during failures.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks kafka_cluster_enhanced_monitoring_enabled

Recommendation

Select an enhanced level (e.g., PER_BROKER or finer) and establish observability: prioritize telemetry for broker resources, replication health, and consumer lag. Configure alerts and dashboards aligned to SLOs to enable proactive scaling and rapid incident containment. Balance granularity with cost.

Remediation

CLI

aws kafka update-monitoring --cluster-arn <CLUSTER_ARN> --current-version <CURRENT_VERSION> --enhanced-monitoring PER_BROKER

Terraform

# Terraform: Enable enhanced monitoring on an MSK cluster
resource "aws_msk_cluster" "<example_resource_name>" {
  cluster_name           = "<example_resource_name>"
  kafka_version          = "<example_kafka_version>"
  number_of_broker_nodes = 2

  broker_node_group_info {
    instance_type  = "kafka.t3.small"
    client_subnets = ["<example_subnet_id_1>", "<example_subnet_id_2>"]
  }

  enhanced_monitoring = "PER_BROKER" # Critical: sets monitoring above DEFAULT to pass the check
}

NativeIaC

# CloudFormation: Enable enhanced monitoring on an MSK cluster
Resources:
  <example_resource_name>:
    Type: AWS::MSK::Cluster
    Properties:
      ClusterName: <example_resource_name>
      KafkaVersion: <example_kafka_version>
      NumberOfBrokerNodes: 2
      BrokerNodeGroupInfo:
        ClientSubnets:
          - <example_subnet_id_1>
          - <example_subnet_id_2>
        InstanceType: kafka.t3.small
      EnhancedMonitoring: PER_BROKER  # Critical: sets enhanced monitoring above DEFAULT to pass the check

Other

1Open the AWS Console and go to Amazon MSK
2Select your provisioned cluster
3Click Edit
4Under Monitoring, set Enhanced monitoring to PER_BROKER (or higher)
5Save changes and wait for the update to complete

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.kafka.kafka_client import kafka_client


class kafka_cluster_enhanced_monitoring_enabled(Check):
    def execute(self):
        findings = []

        for cluster in kafka_client.clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = (
                f"Kafka cluster '{cluster.name}' has enhanced monitoring enabled."
            )

            # Serverless clusters always have enhanced monitoring enabled by default
            if cluster.kafka_version == "SERVERLESS":
                report.status = "PASS"
                report.status_extended = f"Kafka cluster '{cluster.name}' is serverless and always has enhanced monitoring enabled by default."
            # For provisioned clusters, check the enhanced monitoring configuration
            elif cluster.enhanced_monitoring == "DEFAULT":
                report.status = "FAIL"
                report.status_extended = f"Kafka cluster '{cluster.name}' does not have enhanced monitoring enabled."

            findings.append(report)

        return findings

References