Profile Applicability
- Level 2
Description
Exposing Kafka clusters to the public internet can lead to unauthorized access, data breaches, and potential misuse of sensitive information. Ensuring that Kafka clusters are accessible only through secure and trusted networks mitigates these risks and aligns with security best practices.
Rationale
Enhanced Security: Prevents unauthorized access to Kafka clusters and sensitive data.
Risk Mitigation: Reduces the attack surface and protects against malicious activities.
Compliance: Aligns with regulatory requirements for securing data and infrastructure.
Impact
Pros:
Protects Kafka clusters from unauthorized access and potential data breaches.
Reduces the risk of exploitation and misuse of sensitive data.
Enhances overall security posture and compliance.
Cons:
May require additional configuration for secure access, such as VPNs or private endpoints.
Could disrupt workflows if public access was previously relied upon.
Default Value
By default, Kafka clusters may be accessible from the public internet if not explicitly restricted.
Pre-Requisite
IAM Permissions:
kafka:DescribeCluster
kafka:UpdateClusterConfiguration
AWS CLI installed and configured.
Remediation
Test Plan:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to the MSK Dashboard.
Select Clusters from the left-hand menu.
Check the Access Control settings for each cluster and ensure that public access is disabled.
Using AWS CLI:
Verify Public Access Settings:
aws kafka describe-cluster --cluster-arn <cluster-arn> --query "ClusterInfo.BrokerNodeGroupInfo.ClientSubnets"
Ensure that the subnets are private and not exposed to the public internet.
Implementation Steps:
Using AWS Console:
Sign in to the AWS Management Console.
Navigate to the MSK Dashboard.
Select the cluster to update.
Edit the cluster configuration to restrict access to private subnets or trusted networks.
Save the changes.
Using AWS CLI:
Update the Cluster Configuration:
aws kafka update-cluster-configuration --cluster-arn <cluster-arn> --configuration-info file://config.json
Verify the Changes:
aws kafka describe-cluster --cluster-arn <cluster-arn> --query "ClusterInfo.BrokerNodeGroupInfo.ClientSubnets"
Backout Plan
Using AWS Console:
If restricting access causes issues with application connectivity, sign in to the AWS Management Console.
Navigate to Amazon MSK, select the Kafka cluster, and review the security group and VPC settings.
Revert the changes to allow broader access (although this is not recommended for security purposes).
Save the changes and verify that the Kafka cluster is accessible again.
Using AWS CLI:
If restricting access causes connectivity issues, you can revert the security group to allow broader access:
aws ec2 modify-security-group-rules --region <REGION> --group-id <SECURITY_GROUP_ID> --protocol tcp --port 9092 --cidr 0.0.0.0/0
Verify that the Kafka cluster is now publicly accessible (again, this is not recommended):
aws ec2 describe-security-groups --group-ids <SECURITY_GROUP_ID> --region <REGION>