Back to Checks
aws

Kafka cluster requires authentication

kafka_cluster_unrestricted_access_disabled
Service: kafkaSeverity: critical
OfficialBuilt-inVerified
Categories:identity-access
Resource Type:AwsMskCluster

Amazon MSK clusters are evaluated for unauthenticated client access. Serverless clusters inherently require authentication; provisioned clusters are checked for configurations that allow unrestricted connections rather than authenticated clients.

Prowler logoProwlerprowler-provider-aws

Risk

Allowing unauthenticated access lets anyone connect and:

  • Read sensitive topics (confidentiality)
  • Publish or alter data (integrity)
  • Overload brokers and consumers (availability)

This enables message exfiltration, stream poisoning, and abuse of trusted data pipelines.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks kafka_cluster_unrestricted_access_disabled

Recommendation

Disable unauthenticated access and require strong client authentication (mTLS or IAM/SASL).

  • Enforce least privilege with scoped ACLs
  • Restrict network paths via private connectivity and tight security groups
  • Encrypt in transit, monitor access, and rotate credentials regularly

Remediation

CLI

aws kafka update-security --cluster-arn <example_resource_arn> --current-version <example_current_version> --client-authentication 'Unauthenticated={Enabled=false}'

Terraform

# Terraform: Disable unauthenticated client access for MSK
resource "aws_msk_cluster" "<example_resource_name>" {
  cluster_name           = "<example_resource_name>"
  kafka_version          = "<example_kafka_version>"
  number_of_broker_nodes = 2

  broker_node_group_info {
    instance_type   = "<example_instance_type>"
    client_subnets  = ["<subnet_id_1>", "<subnet_id_2>"]
    ebs_volume_size = 1000
  }

  client_authentication {
    unauthenticated = false  # CRITICAL: Disables unauthenticated client access
  }
}

NativeIaC

# CloudFormation: Disable unauthenticated client access for MSK
Resources:
  <example_resource_name>:
    Type: AWS::MSK::Cluster
    Properties:
      ClusterName: <example_resource_name>
      KafkaVersion: <example_kafka_version>
      NumberOfBrokerNodes: 2
      BrokerNodeGroupInfo:
        InstanceType: <example_instance_type>
        ClientSubnets:
          - <subnet_id_1>
          - <subnet_id_2>
        StorageInfo:
          EbsStorageInfo:
            VolumeSize: 1000
      ClientAuthentication:
        Unauthenticated:
          Enabled: false  # CRITICAL: Disables unauthenticated client access

Other

1Open the AWS Console and go to Amazon MSK
2Select your cluster and open the Security tab
3Click Edit under Client authentication
4Turn off/clear Unauthenticated access
5Save changes to apply the update

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.kafka.kafka_client import kafka_client


class kafka_cluster_unrestricted_access_disabled(Check):
    def execute(self):
        findings = []

        for cluster in kafka_client.clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "FAIL"
            report.status_extended = (
                f"Kafka cluster '{cluster.name}' has unrestricted access enabled."
            )

            # Serverless clusters always require authentication by default
            if cluster.kafka_version == "SERVERLESS":
                report.status = "PASS"
                report.status_extended = f"Kafka cluster '{cluster.name}' is serverless and always requires authentication by default."
            # For provisioned clusters, check the unauthenticated access configuration
            elif not cluster.unauthentication_access:
                report.status = "PASS"
                report.status_extended = f"Kafka cluster '{cluster.name}' does not have unrestricted access enabled."

            findings.append(report)

        return findings

References