> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Msk in cluster node require tsl remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration of MSK Cluster Encryption In Transit not being enabled for AWS RDS using the AWS console, follow these steps:

        1. **Sign in to the AWS Management Console:**
           * Go to the AWS Management Console at [https://aws.amazon.com/console/](https://aws.amazon.com/console/).

        2. **Navigate to the Amazon RDS Console:**
           * Click on the "Services" dropdown menu at the top left corner.
           * Under the "Database" section, click on "RDS".

        3. **Select the RDS Instance:**
           * In the Amazon RDS dashboard, select the RDS instance that you want to enable encryption in transit for.

        4. **Modify the RDS Instance:**
           * Click on the checkbox next to the RDS instance you selected.
           * Click on the "Modify" button at the top.

        5. **Enable Encryption in Transit:**
           * Scroll down to the "Network & Security" section.
           * Under the "Additional configuration" heading, look for the "Encryption" option.
           * Select the option for "Encryption in transit".
           * Choose the appropriate encryption type (SSL/TLS) from the dropdown menu.

        6. **Save the Changes:**
           * Scroll to the bottom of the page and click on the "Continue" button.
           * Review the changes you are about to make.
           * Click on the "Modify DB Instance" button to apply the changes.

        7. **Monitor the Modification Progress:**
           * Wait for the modification process to complete. This may take a few minutes.
           * You can monitor the progress in the RDS dashboard or through the "Modify" option.

        8. **Verify Encryption in Transit:**
           * Once the modification is complete, verify that encryption in transit is enabled for the RDS instance.
           * You can check the encryption status in the RDS console or by connecting to the RDS instance and checking the encryption settings.

        By following these steps, you can successfully remediate the misconfiguration of MSK Cluster Encryption In Transit not being enabled for AWS RDS using the AWS console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of MSK Cluster Encryption In Transit not being enabled for AWS RDS using AWS CLI, you can follow these steps:

        1. Open the AWS CLI and run the following command to enable encryption in transit for the MSK cluster:

        ```bash theme={null}
        aws rds modify-db-cluster --db-cluster-identifier your-db-cluster-name --enable-http-endpoint --apply-immediately
        ```

        Make sure to replace `your-db-cluster-name` with the actual name of your RDS DB cluster.

        2. Wait for the modification to be completed. You can check the status of the modification by running the following command:

        ```bash theme={null}
        aws rds describe-db-clusters --db-cluster-identifier your-db-cluster-name --query 'DBClusters[0].Endpoint'
        ```

        Replace `your-db-cluster-name` with the actual name of your RDS DB cluster.

        3. Once the modification is completed, verify that encryption in transit is enabled for the MSK cluster by running the following command:

        ```bash theme={null}
        aws rds describe-db-clusters --db-cluster-identifier your-db-cluster-name --query 'DBClusters[0].Endpoint'
        ```

        Replace `your-db-cluster-name` with the actual name of your RDS DB cluster.

        By following these steps, you can successfully remediate the misconfiguration of MSK Cluster Encryption In Transit not being enabled for AWS RDS using AWS CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration of MSK Cluster Encryption In Transit not being enabled for AWS RDS using Python, you can follow these steps:

        1. Import the necessary libraries:

        ```python theme={null}
        import boto3
        ```

        2. Initialize the AWS RDS client:

        ```python theme={null}
        rds_client = boto3.client('rds')
        ```

        3. Get a list of all RDS instances:

        ```python theme={null}
        response = rds_client.describe_db_instances()
        ```

        4. Iterate through each RDS instance and enable encryption in transit for MSK Cluster:

        ```python theme={null}
        for db_instance in response['DBInstances']:
            db_instance_identifier = db_instance['DBInstanceIdentifier']
            
            # Modify the DB instance to enable encryption in transit for MSK Cluster
            rds_client.modify_db_instance(
                DBInstanceIdentifier=db_instance_identifier,
                MSKClusterEncryption={'Enabled': True}
            )
        ```

        5. Verify that encryption in transit for MSK Cluster is enabled by checking the DB instance details:

        ```python theme={null}
        response = rds_client.describe_db_instances(DBInstanceIdentifier=db_instance_identifier)
        msk_cluster_encryption = response['DBInstances'][0]['MSKClusterEncryption']

        if msk_cluster_encryption['Status'] == 'enabled':
            print(f"Encryption in transit for MSK Cluster is successfully enabled for RDS instance: {db_instance_identifier}")
        else:
            print(f"Failed to enable encryption in transit for MSK Cluster for RDS instance: {db_instance_identifier}")
        ```

        By following these steps, you can remediate the misconfiguration of MSK Cluster Encryption In Transit not being enabled for AWS RDS using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "aws_msk_cluster" "THIS_MSK_CLUSTER" {
          cluster_name           = "REPLACE_WITH_CLUSTER_NAME"
          kafka_version          = "REPLACE_WITH_KAFKA_VERSION"
          number_of_broker_nodes = REPLACE_WITH_BROKER_NODE_COUNT

          broker_node_group_info {
            instance_type   = "REPLACE_WITH_INSTANCE_TYPE"
            client_subnets  = [REPLACE_WITH_SUBNET_IDS]
            security_groups = [REPLACE_WITH_SG_IDS]
          }

          encryption_info {
            encryption_in_transit {
              # This must be true to require TLS for in-cluster broker node connections
              in_cluster = true

              # Optionally also enforce TLS for client-to-broker traffic:
              # client_broker = "TLS"   # or "TLS_PLAINTEXT" / "PLAINTEXT" per your policy
            }

            # Other encryption settings as needed, for example:
            # encryption_at_rest_kms_key_arn = "REPLACE_WITH_KMS_KEY_ARN"
          }

          # ...any other required arguments (monitoring, logging, tags, etc.)
        }
        ```

        Substitute:

        * `THIS_MSK_CLUSTER` with your Terraform resource name.
        * `REPLACE_WITH_CLUSTER_NAME` with the MSK cluster name.
        * `REPLACE_WITH_KAFKA_VERSION` with a valid Kafka version (e.g., `"3.6.0"`).
        * `REPLACE_WITH_BROKER_NODE_COUNT` with the desired integer node count.
        * `REPLACE_WITH_INSTANCE_TYPE` with a supported broker instance type.
        * `REPLACE_WITH_SUBNET_IDS` with a list of subnet IDs.
        * `REPLACE_WITH_SG_IDS` with a list of security group IDs.
        * Optionally `REPLACE_WITH_KMS_KEY_ARN` with a KMS key ARN if using encryption at rest.

        Changing `encryption_info.encryption_in_transit.in_cluster` from `false` to `true` generally forces replacement of the MSK cluster, which can cause downtime; plan carefully before applying.

        This AWS Config rule is specific to Amazon MSK and does not apply to RDS; there is no equivalent “in-cluster broker TLS” setting on RDS instances.

        For verification, `terraform plan` should show:

        * `encryption_info.0.encryption_in_transit.0.in_cluster` changing to `true` on the MSK cluster.
        * A resource replacement if the cluster previously had `in_cluster = false` or omitted.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>