Description

Detects Amazon MSK (Managed Streaming for Kafka) clusters that are configured with public accessibility. When an MSK cluster is publicly accessible through service-provided Elastic IPs, it increases the attack surface by allowing potential access from the internet, which could lead to unauthorized access to your Kafka resources.

Detection Strategy

• Scans all MSK clusters in the specified AWS region (excluding serverless clusters)

• Checks if the cluster's public access type is set to 'SERVICE_PROVIDED_EIPS'

• Reports a vulnerability if the cluster is configured to be publicly accessible through Elastic IPs