Amazon MSK clusters should have public access disabled

How to fix it

Set the named cluster's public access type to DISABLED, so its brokers are reachable only from inside its VPC. This is an in-place change to a running cluster, but the operation needs the cluster's current version number, which the finding does not carry, so read it from the cluster's own description first. It withdraws the public bootstrap addresses with no redirect to the private ones, so move any client still using them into the VPC, or onto a VPN connection, Direct Connect or VPC peering, first.

In the console

Managed Streaming for Apache Kafka → Clusters → the cluster → Properties → Networking settings

With the AWS CLI

aws kafka update-connectivity --cluster-arn <cluster-arn> --current-version <current-version> --connectivity-info '{"PublicAccess":{"Type":"DISABLED"}}' --region <region>

With Terraform

resource "aws_msk_cluster" "this" {
  cluster_name           = var.cluster_name
  kafka_version          = var.kafka_version
  number_of_broker_nodes = var.number_of_broker_nodes

  broker_node_group_info {
    client_subnets  = var.client_subnets
    instance_type   = var.instance_type
    security_groups = var.security_groups

    connectivity_info {
      public_access {
        type = "DISABLED"
      }
    }
  }
}