Profile Applicability
- Level 2
Description
Mutual TLS (mTLS) authentication ensures that both the client and the server authenticate each other during communication. This provides an additional layer of security for Kafka clusters by ensuring that only trusted clients can connect to the cluster. Enabling mTLS is a critical step in securing sensitive data and preventing unauthorized access.
Rationale
Enhanced Security: Ensures that only trusted clients can connect to Kafka clusters.
Compliance: Meets regulatory requirements for secure communication and data protection.
Risk Mitigation: Reduces the risk of unauthorized access and man-in-the-middle attacks.
Impact
Pros:
Provides strong authentication for both clients and servers.
Enhances data security by encrypting communication.
Aligns with compliance and security standards.
Cons:
Requires additional configuration and management of certificates.
May introduce slight latency due to encryption overhead.
Default Value
By default, Kafka clusters do not enforce mTLS authentication. This must be explicitly configured.
Pre-Requisite
IAM Permissions:
kafka:DescribeCluster
kafka:UpdateClusterConfiguration
AWS CLI installed and configured.
Remediation
Test Plan:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to the MSK Dashboard.
Select Clusters from the left-hand menu.
Check the Security Settings for each cluster and verify if mTLS authentication is enabled.
Using AWS CLI:
Verify mTLS Authentication Settings:
aws kafka describe-cluster --cluster-arn <cluster-arn> --query "ClusterInfo.ClientAuthentication.Tls"
Ensure that the Tls field is set to Enabled.
Implementation Steps:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to the MSK Dashboard.
Select the cluster to update.
Edit the cluster configuration to enable mTLS authentication using AWS Certificate Manager (ACM).
Save the changes.
Using AWS CLI:
Enable mTLS Authentication:
aws kafka update-cluster-configuration --cluster-arn <cluster-arn> --configuration-info file://config.json
Verify the Changes:
aws kafka describe-cluster --cluster-arn <cluster-arn> --query "ClusterInfo.ClientAuthentication.Tls"
Backout Plan
Using AWS Console:
If enabling Mutual TLS Authentication causes issues with client connections, sign in to the AWS Management Console.
Navigate to Amazon MSK, select the Kafka cluster, and go to Edit.
Disable Mutual TLS Authentication and switch to standard TLS encryption (i.e., without client authentication).
Save the changes and verify that clients are able to reconnect.
Using AWS CLI:
To disable Mutual TLS Authentication, run the following command:
aws kafka update-cluster-configuration --cluster-arn <CLUSTER_ARN> --encryption-in-transit '{"enabled": true, "clientBroker": "TLS"}' --region <REGION>Verify that Mutual TLS Authentication is no longer enabled:
aws kafka describe-cluster --cluster-arn <CLUSTER_ARN> --region <REGION>