Back to Checks
aws

Amazon MQ broker is not publicly accessible

mq_broker_not_publicly_accessible
Service: mqSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:AwsAmazonMQBroker

Amazon MQ brokers are evaluated for public accessibility, determining whether a broker exposes a public endpoint or is restricted to VPC-only connectivity via its publicly accessible setting.

Prowler logoProwlerprowler-provider-aws

Risk

Publicly reachable brokers expand exposure: internet hosts can probe protocols and consoles, attempt credential spraying, publish/consume messages, and flood connections. This threatens confidentiality (data leakage), integrity (message tampering), and availability (DoS/resource exhaustion).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks mq_broker_not_publicly_accessible

Recommendation

Prefer private deployment: set publicly_accessible=false, place brokers in private subnets, and restrict security groups to trusted producers/consumers. Use private connectivity (VPC endpoints, peering, VPN/Direct Connect). Enforce strong authn and authorization maps, and allow only required protocol ports. Apply least privilege.

Remediation

Terraform

# Amazon MQ broker without public accessibility
resource "aws_mq_broker" "<example_resource_name>" {
  broker_name         = "<example_resource_name>"
  engine_type         = "ActiveMQ"
  engine_version      = "<example_engine_version>"
  host_instance_type  = "<example_instance_type>"
  publicly_accessible = false # Critical: disables public internet access
  security_groups     = ["<example_security_group_id>"]
  subnet_ids          = ["<example_subnet_id>"]

  user {
    username = "<example_username>"
    password = "<example_password>"
  }
}

NativeIaC

# CloudFormation: Amazon MQ broker without public accessibility
Resources:
  <example_resource_name>:
    Type: AWS::AmazonMQ::Broker
    Properties:
      BrokerName: <example_resource_name>
      EngineType: ACTIVEMQ
      EngineVersion: <example_engine_version>
      HostInstanceType: <example_instance_type>
      PubliclyAccessible: false  # Critical: disables public internet access
      Users:
        - Username: <example_username>
          Password: <example_password>
      SubnetIds:
        - <example_subnet_id>
      SecurityGroups:
        - <example_security_group_id>
      AutoMinorVersionUpgrade: true

Other

1Open the AWS Console and go to Amazon MQ
2Create a new broker and set Public accessibility to Disabled/No
3Point your clients to the new broker's private endpoints
4Delete the old publicly accessible broker

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.mq.mq_client import mq_client


class mq_broker_not_publicly_accessible(Check):
    def execute(self):
        findings = []
        for broker in mq_client.brokers.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=broker)
            report.status = "FAIL"
            report.status_extended = f"MQ Broker {broker.name} is publicly accessible."

            if not broker.publicly_accessible:
                report.status = "PASS"
                report.status_extended = (
                    f"MQ Broker {broker.name} is not publicly accessible."
                )

            findings.append(report)

        return findings

References