aws-msk-update-cluster-config
kafka:UpdateClusterConfiguration applies a new Kafka broker configuration version to the MSK cluster, affecting settings such as auto.create.topics.enable, log retention, and replication factors.
match (effective permission)
{
"action": "kafka:UpdateClusterConfiguration",
"resource_type": "AWS::MSK::Cluster"
}
emit
| source type | Identity |
|---|---|
| target type | GenericMessaging |
| source | <principal> |
| target | <MSK Cluster (GenericMessaging)> |
| permissions | kafka:UpdateClusterConfiguration |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective kafka:UpdateClusterConfiguration on the cluster ARN. This modifies broker-level Kafka settings. Analyst note: enabling auto.create.topics.enable is particularly significant — it allows producers to create new topics implicitly, broadening the WriteData attack surface without explicit kafka-cluster:CreateTopic permission. BLOCKED by SCP or boundary denial. |
Narrative
{principal.name} can apply a new Kafka broker configuration to cluster {target.name} (kafka:UpdateClusterConfiguration), altering settings such as auto.create.topics.enable, retention policies, and replication factors - changes that can expand the cluster's data-plane attack surface.
Raw rule rules/derived/aws/msk.yaml
id: aws-msk-update-cluster-config
emits: CanModifyConfiguration
description: kafka:UpdateClusterConfiguration applies a new Kafka broker configuration version to the
MSK cluster, affecting settings such as auto.create.topics.enable, log retention, and replication factors.
match_effective_permission:
action: kafka:UpdateClusterConfiguration
resource_type: AWS::MSK::Cluster
emit:
source_type: Identity
target_type: GenericMessaging
source: <principal>
target: <MSK Cluster (GenericMessaging)>
permissions:
- kafka:UpdateClusterConfiguration
conditions:
- iam_permission
state_logic: "ACTIVE when the principal has effective kafka:UpdateClusterConfiguration on the cluster\
\ ARN. This modifies broker-level Kafka settings. Analyst note: enabling auto.create.topics.enable\
\ is particularly significant \u2014 it allows producers to create new topics implicitly, broadening\
\ the WriteData attack surface without explicit kafka-cluster:CreateTopic permission. BLOCKED by SCP\
\ or boundary denial."
derived_from:
- effective kafka:UpdateClusterConfiguration on cluster ARN
false_positive_note: "Cluster configuration changes require a rolling broker restart (MSK handles this\
\ automatically), which temporarily disrupts broker availability. The security consequence of the\
\ configuration change (e.g. enabling auto topic creation) is gradual \u2014 it takes effect after\
\ the rolling restart completes. Not a real-time escalation but a persistent configuration modification."
narrative: "{principal.name} can apply a new Kafka broker configuration to cluster {target.name} (kafka:UpdateClusterConfiguration),\
\ altering settings such as auto.create.topics.enable, retention policies, and replication factors\
\ \u2014 changes that can expand the cluster's data-plane attack surface."