How can I monitor MSK clusters to determine if they have mTLS authentication enabled?

Question

I have a use case where I need to monitor consumers and producers of of kafka to determine if they have mTLS authentication enabled. This is done using a third party security tool.

My question for the Amazon side of things is, is this configuration a flag in the AWS Console that I can see or the is this configuration stored on the EC2 instances itself? Such as in a file or so forth?

What would be a solution to achieve this goal? Any suggestions will also help.

Hitesh · Answer

1. Is this configuration a flag in the AWS Console that I can see :- Yes, You can see mTLS is enabled or not via MSK console, Go to the Amazon MSK console -->Select your cluster -->Go to the "Security" tab -->Look for the "TLS client authentication through AWS Certificate Manager (ACM)" ( You would see as "Enabled" or "Disabled")

2. You can also describe the cluster using AWS CLI :- aws kafka describe-cluster --cluster-arn YOUR_CLUSTER_ARN
Look for the "ClientAuthentication" section in the output. If mTLS is enabled, you should see "Enabled": true under "Tls" section.

Sample snippet of output :-

```
"ClientAuthentication": {

"Tls": {
            "CertificateAuthorityArnList": [
                "arn-of-your-acm-pca"
            ],
            "Enabled": true
        },
```

3. AWS Config :- You can use AWS Config to create a rule that checks for the desired security settings in your MSK clusters. While, there isn't a ready-made managed rule, you can create your own rule. You can check reference here :- https://docs.aws.amazon.com/config/latest/developerguide/msk-in-cluster-node-require-tls.html

How can I monitor MSK clusters to determine if they have mTLS authentication enabled?

Add your answer

Relevant content