Back to Checks
aws

MSK cluster uses the latest Kafka version or is serverless with AWS-managed version

kafka_cluster_uses_latest_version
Service: kafkaSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilities
Resource Type:AwsMskCluster

Amazon MSK clusters are evaluated for use of the latest supported Apache Kafka version. Provisioned clusters are compared to the most recent release, while serverless clusters are treated as automatically managed for versioning.

Prowler logoProwlerprowler-provider-aws

Risk

Outdated Kafka enables exploitation of known flaws and weak cryptography, risking data exposure or tampering (confidentiality/integrity). Missing fixes increase broker crashes and partition instability (availability). After end of support, silent auto-upgrades can trigger unexpected behavior and compatibility issues.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks kafka_cluster_uses_latest_version

Recommendation

Adopt a controlled upgrade strategy:

  • Track MSK version support and upgrade before end of support
  • Test in staging and schedule maintenance windows
  • Use blue/green or rolling upgrades to reduce downtime
  • Validate client compatibility and security settings
  • Consider serverless MSK if automatic versioning fits your risk model

Remediation

CLI

aws kafka update-cluster-kafka-version --cluster-arn <example_resource_id> --current-version <current_version> --target-kafka-version <latest_version>

Terraform

# Terraform: Upgrade MSK cluster to latest Kafka version
resource "aws_msk_cluster" "<example_resource_name>" {
  cluster_name           = "<example_resource_name>"
  kafka_version          = "<latest_version>"  # CRITICAL: set to the latest Kafka version to pass the check
  number_of_broker_nodes = 2

  broker_node_group_info {
    instance_type  = "kafka.m5.large"
    client_subnets = ["<example_resource_id>", "<example_resource_id>"]

    storage_info {
      ebs_storage_info { volume_size = 1000 }
    }
  }
}

NativeIaC

# CloudFormation: Upgrade MSK cluster to latest Kafka version
Resources:
  <example_resource_name>:
    Type: AWS::MSK::Cluster
    Properties:
      ClusterName: <example_resource_name>
      KafkaVersion: <latest_version>  # CRITICAL: set to the latest Kafka version to pass the check
      NumberOfBrokerNodes: 2
      BrokerNodeGroupInfo:
        InstanceType: kafka.m5.large
        ClientSubnets:
          - <example_resource_id>
          - <example_resource_id>

Other

1Open the AWS Management Console and go to Amazon MSK
2Select your cluster and choose Actions > Update cluster
3In Kafka version, select the latest available version
4Review and start the upgrade (Update/Start upgrade)
5Wait until the operation completes and the cluster status returns to Active

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.kafka.kafka_client import kafka_client


class kafka_cluster_uses_latest_version(Check):
    def execute(self):
        findings = []

        for cluster in kafka_client.clusters.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=cluster)
            report.status = "PASS"
            report.status_extended = (
                f"Kafka cluster '{cluster.name}' is using the latest version."
            )

            # Serverless clusters don't have specific Kafka versions - AWS manages them automatically
            if cluster.kafka_version == "SERVERLESS":
                report.status = "PASS"
                report.status_extended = f"Kafka cluster '{cluster.name}' is serverless and AWS automatically manages the Kafka version."
            # For provisioned clusters, check if they're using the latest version
            elif cluster.kafka_version != kafka_client.kafka_versions[-1].version:
                report.status = "FAIL"
                report.status_extended = (
                    f"Kafka cluster '{cluster.name}' is not using the latest version."
                )

            findings.append(report)

        return findings

References