> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# MSK Cluster Encryption In Transit Should Be Enabled

### More Info:

This rule checks if an Amazon MSK cluster enforces encryption in transit using HTTPS (TLS) with the broker nodes of the cluster. It marks the rule as NON\_COMPLIANT if plain text communication is enabled for in-cluster broker node connections.

### Risk Level

Medium

### Address

Security

### Compliance Standards

CBP

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of MSK Cluster Encryption In Transit not being enabled for AWS RDS using the AWS console, follow these steps:

        1. **Sign in to the AWS Management Console:**
           * Go to the AWS Management Console at [https://aws.amazon.com/console/](https://aws.amazon.com/console/).

        2. **Navigate to the Amazon RDS Console:**
           * Click on the "Services" dropdown menu at the top left corner.
           * Under the "Database" section, click on "RDS".

        3. **Select the RDS Instance:**
           * In the Amazon RDS dashboard, select the RDS instance that you want to enable encryption in transit for.

        4. **Modify the RDS Instance:**
           * Click on the checkbox next to the RDS instance you selected.
           * Click on the "Modify" button at the top.

        5. **Enable Encryption in Transit:**
           * Scroll down to the "Network & Security" section.
           * Under the "Additional configuration" heading, look for the "Encryption" option.
           * Select the option for "Encryption in transit".
           * Choose the appropriate encryption type (SSL/TLS) from the dropdown menu.

        6. **Save the Changes:**
           * Scroll to the bottom of the page and click on the "Continue" button.
           * Review the changes you are about to make.
           * Click on the "Modify DB Instance" button to apply the changes.

        7. **Monitor the Modification Progress:**
           * Wait for the modification process to complete. This may take a few minutes.
           * You can monitor the progress in the RDS dashboard or through the "Modify" option.

        8. **Verify Encryption in Transit:**
           * Once the modification is complete, verify that encryption in transit is enabled for the RDS instance.
           * You can check the encryption status in the RDS console or by connecting to the RDS instance and checking the encryption settings.

        By following these steps, you can successfully remediate the misconfiguration of MSK Cluster Encryption In Transit not being enabled for AWS RDS using the AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of MSK Cluster Encryption In Transit not being enabled for AWS RDS using AWS CLI, you can follow these steps:

        1. Open the AWS CLI and run the following command to enable encryption in transit for the MSK cluster:

        ```bash theme={null}
        aws rds modify-db-cluster --db-cluster-identifier your-db-cluster-name --enable-http-endpoint --apply-immediately
        ```

        Make sure to replace `your-db-cluster-name` with the actual name of your RDS DB cluster.

        2. Wait for the modification to be completed. You can check the status of the modification by running the following command:

        ```bash theme={null}
        aws rds describe-db-clusters --db-cluster-identifier your-db-cluster-name --query 'DBClusters[0].Endpoint'
        ```

        Replace `your-db-cluster-name` with the actual name of your RDS DB cluster.

        3. Once the modification is completed, verify that encryption in transit is enabled for the MSK cluster by running the following command:

        ```bash theme={null}
        aws rds describe-db-clusters --db-cluster-identifier your-db-cluster-name --query 'DBClusters[0].Endpoint'
        ```

        Replace `your-db-cluster-name` with the actual name of your RDS DB cluster.

        By following these steps, you can successfully remediate the misconfiguration of MSK Cluster Encryption In Transit not being enabled for AWS RDS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of MSK Cluster Encryption In Transit not being enabled for AWS RDS using Python, you can follow these steps:

        1. Import the necessary libraries:

        ```python theme={null}
        import boto3
        ```

        2. Initialize the AWS RDS client:

        ```python theme={null}
        rds_client = boto3.client('rds')
        ```

        3. Get a list of all RDS instances:

        ```python theme={null}
        response = rds_client.describe_db_instances()
        ```

        4. Iterate through each RDS instance and enable encryption in transit for MSK Cluster:

        ```python theme={null}
        for db_instance in response['DBInstances']:
            db_instance_identifier = db_instance['DBInstanceIdentifier']
            
            # Modify the DB instance to enable encryption in transit for MSK Cluster
            rds_client.modify_db_instance(
                DBInstanceIdentifier=db_instance_identifier,
                MSKClusterEncryption={'Enabled': True}
            )
        ```

        5. Verify that encryption in transit for MSK Cluster is enabled by checking the DB instance details:

        ```python theme={null}
        response = rds_client.describe_db_instances(DBInstanceIdentifier=db_instance_identifier)
        msk_cluster_encryption = response['DBInstances'][0]['MSKClusterEncryption']

        if msk_cluster_encryption['Status'] == 'enabled':
            print(f"Encryption in transit for MSK Cluster is successfully enabled for RDS instance: {db_instance_identifier}")
        else:
            print(f"Failed to enable encryption in transit for MSK Cluster for RDS instance: {db_instance_identifier}")
        ```

        By following these steps, you can remediate the misconfiguration of MSK Cluster Encryption In Transit not being enabled for AWS RDS using Python.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>