aws-msk-public-access

id: aws-msk-public-access
emits: ExposedToInternet
description: An MSK cluster with publiclyAccessible enabled and an open broker security group (port 9198
  from 0.0.0.0/0) is internet-reachable; IAM or SASL/SCRAM authentication still required.
match_record:
  resource_type: AWS::MSK::Cluster
  field: connectivityInfo.publicAccess.type
where:
- cluster.connectivityInfo.publicAccess.type in [SERVICE_PROVIDED_EIPS, MULTI_VPC]
- OR cluster.connectivityInfo.publicAccess.type != DISABLED (for ServerlessCluster)
- broker security groups allow inbound TCP port 9198 from 0.0.0.0/0 or ::/0 (confirmed by SecurityGroup
  rule evaluation)
emit:
  source_type: GenericMessaging
  target_type: AnonymousIdentity
  source: <MSK Cluster (GenericMessaging)>
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - network_reachability
  state_logic: "ACTIVE when public access is enabled (connectivityInfo.publicAccess.type != DISABLED)\
    \ AND the broker ENI security groups allow port 9198 inbound from 0.0.0.0/0. CONDITIONAL(network_reachability)\
    \ when public access is enabled but the SG rule is not confirmed (collector could not evaluate the\
    \ SG). Note: even with public internet reachability, clients must still authenticate (IAM, SASL/SCRAM,\
    \ or mTLS) unless unauthenticated access is also enabled \u2014 ExposedToInternet here means the BROKER\
    \ ENDPOINT is internet-reachable, not that it is anonymously accessible. Emit with a note about authentication\
    \ requirements in the narrative."
  derived_from:
  - AWS::MSK::Cluster.connectivityInfo.publicAccess.type (kafka:DescribeCluster)
  - SecurityGroup inbound rules (ec2:DescribeSecurityGroups)
  false_positive_note: "publiclyAccessible alone (without SG open) does NOT make the cluster reachable\
    \ from the internet \u2014 the default SG created by MSK restricts inbound to the VPC. Require BOTH\
    \ conditions: (1) publicAccess.type != DISABLED and (2) SG allows port 9198 from 0.0.0.0/0. If SG\
    \ evaluation is unavailable, downgrade to CONDITIONAL(network_reachability). Also: public access assigns\
    \ public IPs to brokers at port 9198 (TLS) only; non-TLS endpoints are not publicly accessible. MSK\
    \ Serverless clusters are always private (PrivateLink); public access applies only to provisioned\
    \ clusters."
  narrative: MSK cluster {source.name} has public broker access enabled (connectivityInfo.publicAccess.type)
    and a security group permitting inbound on port 9198; the TLS broker endpoints are internet-reachable
    (authentication still required for data-plane access).