aws-msk-update-security
kafka:UpdateSecurity modifies cluster authentication and encryption settings, including potentially enabling unauthenticated client access, which removes the IAM and Kafka ACL authorization gates.
match (effective permission)
{
"action": "kafka:UpdateSecurity",
"resource_type": "AWS::MSK::Cluster"
}
emit
| source type | Identity |
|---|---|
| target type | GenericMessaging |
| source | <principal> |
| target | <MSK Cluster (GenericMessaging)> |
| permissions | kafka:UpdateSecurity |
| conditions | iam_permission |
| state logic | ACTIVE when the principal has effective kafka:UpdateSecurity on the cluster ARN. CRITICAL: enabling UNAUTHENTICATED client access (setting clientAuthentication.unauthenticated.enabled = true) removes all IAM and Kafka ACL authorization gates from the cluster — any network-reachable client can then produce and consume without credentials. This is a high-impact CanModifyConfiguration edge. BLOCKED by SCP or boundary denial. |
Narrative
{principal.name} can modify cluster {target.name}'s security configuration (kafka:UpdateSecurity), potentially enabling unauthenticated client access, which removes all authorization gates and allows any network-reachable client to produce and consume data.
Raw rule rules/derived/aws/msk.yaml
id: aws-msk-update-security
emits: CanModifyConfiguration
description: kafka:UpdateSecurity modifies cluster authentication and encryption settings, including potentially
enabling unauthenticated client access, which removes the IAM and Kafka ACL authorization gates.
match_effective_permission:
action: kafka:UpdateSecurity
resource_type: AWS::MSK::Cluster
emit:
source_type: Identity
target_type: GenericMessaging
source: <principal>
target: <MSK Cluster (GenericMessaging)>
permissions:
- kafka:UpdateSecurity
conditions:
- iam_permission
state_logic: "ACTIVE when the principal has effective kafka:UpdateSecurity on the cluster ARN. CRITICAL:\
\ enabling UNAUTHENTICATED client access (setting clientAuthentication.unauthenticated.enabled = true)\
\ removes all IAM and Kafka ACL authorization gates from the cluster \u2014 any network-reachable\
\ client can then produce and consume without credentials. This is a high-impact CanModifyConfiguration\
\ edge. BLOCKED by SCP or boundary denial."
derived_from:
- effective kafka:UpdateSecurity on cluster ARN
false_positive_note: "The consequence of enabling unauthenticated access depends on network reachability:\
\ the brokers must still be reachable (VPC-private by default; requires PublicAccess or VPC peering/TGW\
\ for external reach). Do not emit CanWriteData/CanReadData for unauthenticated principals directly\
\ from this rule \u2014 instead flag the configuration change as a high-confidence CanModifyConfiguration\
\ for analyst review. The actual broad data-plane access surface is derived separately when the cluster's\
\ authentication config is observed as unauthenticated=enabled."
narrative: '{principal.name} can modify cluster {target.name}''s security configuration (kafka:UpdateSecurity),
potentially enabling unauthenticated client access, which removes all authorization gates and allows
any network-reachable client to produce and consume data.'