Terraform AWS MSK Kafka Cluster

MSK clusters with broker configuration, encryption in transit and at rest, client authentication, logging, VPC networking, and cluster policies for streaming workloads.

Controls enforced

These compliance controls are checked at terraform plan time.

MSK clusters should be encrypted in transit among broker nodes(low effort)
MSK clusters should have public access disabled(low effort)
MSK clusters should disable unauthenticated access(low effort)

Quick start

module "msk-kafka-cluster" {
  source  = "iso27001.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
  version = "1.0"

  # ... your arguments here
}

module "msk-kafka-cluster" {
  source  = "nis2.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
  version = "1.0"

  # ... your arguments here
}

module "msk-kafka-cluster" {
  source  = "nistcsf.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
  version = "1.0"

  # ... your arguments here
}

module "msk-kafka-cluster" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
  version = "1.0"

  # ... your arguments here
}

module "msk-kafka-cluster" {
  source  = "soc2.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
  version = "1.0"

  # ... your arguments here
}

View this module on the compliance.tf registry — versions, inputs, and outputs →

See the Get Started guide and Registry Endpoints for details on how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "msk-kafka-cluster" {
  source  = "terraform-aws-modules/msk-kafka-cluster/aws"
  version = "1.0"
}

module "msk-kafka-cluster" {
  source  = "soc2.compliance.tf/terraform-aws-modules/msk-kafka-cluster/aws"
  version = "1.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. See the Migration Guide for step-by-step instructions.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "msk-kafka-cluster" {
  source  = "terraform-aws-modules/msk-kafka-cluster/aws"
}

Run terraform init -upgrade. Terraform state is unchanged — same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Mapped compliance frameworks

A.8.12 Data leakage prevention

MSK clusters should be encrypted in transit among broker nodes

A.8.24 Use of cryptography

MSK clusters should be encrypted in transit among broker nodes

6 Security in network and information systems acquisition, development and maintenance

MSK clusters should be encrypted in transit among broker nodes

PR.DS-02

MSK clusters should be encrypted in transit among broker nodes

PR.DS-2

MSK clusters should be encrypted in transit among broker nodes

2.2.7: System components are configured and managed securely.

MSK clusters should be encrypted in transit among broker nodes

4.2.1.1: An inventory of the entity's trusted keys and certificates used to protect PAN during transmission is maintained

MSK clusters should be encrypted in transit among broker nodes

4.2.1.1: PAN is protected with strong cryptography during transmission.

MSK clusters should be encrypted in transit among broker nodes

4.2.1: PAN is protected with strong cryptography during transmission.

MSK clusters should be encrypted in transit among broker nodes

8.3.2: Strong authentication for users and administrators is established and managed.

MSK clusters should be encrypted in transit among broker nodes

8.3.2: Strong cryptography is used to render all authentication factors unreadable during transmission and storage on all system components

MSK clusters should be encrypted in transit among broker nodes

CC6.7 The entity restricts the transmission, movement, and removal of information to authorized internal and external users and processes, and protects it during transmission, movement, or removal to meet the entity's objectives

MSK clusters should be encrypted in transit among broker nodes

Framework coverage

Which controls from this module are active under each framework endpoint.

Control	PCI DSS v4.0	SOC 2
MSK clusters should be encrypted in transit among broker nodes	●	●
MSK clusters should have public access disabled	○	○
MSK clusters should disable unauthenticated access	○	○

● enforced by default · ○ not activated by this endpoint