Project: KICS (Provisioning / Security & Compliance)
File: fc7c2c15-f5d0-4b80-adb2-c89019f8f62b.md

title: MSK Cluster Logging Disabled hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: fc7c2c15-f5d0-4b80-adb2-c89019f8f62b Query name: MSK Cluster Logging Disabled Platform: CloudFormation Severity: <span style="color:#ff7213">Medium</span> Category: Observability URL: Ensure MSK Cluster Logging is enabled<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="6" AWSTemplateFormatVersion: "2010-09-09" Description: MSK Cluster with required properties. Resources: TestCluster5: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: ReplaceWithSubnetId1 ReplaceWithSubnetId2 ReplaceWithSubnetId3 ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="18 12 15" AWSTemplateFormatVersion: "2010-09-09" Description: MSK Cluster with required properties. Resources: TestCluster6: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: false LogGroup: awscloudwatchlog_group.test.name Firehose: Enabled: false LogGroup: firehose.test.name S3: Enabled: false LogGroup: s3.test.name NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: ReplaceWithSubnetId1 ReplaceWithSubnetId2 ReplaceWithSubnetId3 ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="12" AWSTemplateFormatVersion: "2010-09-09" Description: MSK Cluster with required properties. Resources: TestCluster7: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: false LogGroup: awscloudwatchlog_group.test.name NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: ReplaceWithSubnetId1 ReplaceWithSubnetId2 ReplaceWithSubnetId3 ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="7" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "MSK Cluster with required properties.", "Resources": { "TestCluster8": { "Type": "AWS::MSK::Cluster", "Properties": { "ClusterName": "ClusterWithRequiredProperties", "KafkaVersion": "2.2.1", "NumberOfBrokerNodes": 3, "BrokerNodeGroupInfo": { "InstanceType": "kafka.m5.large", "ClientSubnets": [ "ReplaceWithSubnetId1", "ReplaceWithSubnetId2", "ReplaceWithSubnetId3" ] } } } } } ``` </details> <details><summary>Positive test num. 5 - json file</summary> ```json hl_lines="17 21 13" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "MSK Cluster with required properties.", "Resources": { "TestCluster9": { "Type": "AWS::MSK::Cluster", "Properties": { "ClusterName": "ClusterWithRequiredProperties", "KafkaVersion": "2.2.1", "LoggingInfo": { "BrokerLogs": { "CloudWatchLogs": { "Enabled": false, "LogGroup": "awscloudwatchlog_group.test.name" }, "Firehose": { "Enabled": false, "LogGroup": "firehose.test.name" }, "S3": { "Enabled": false, "LogGroup": "s3.test.name" } } }, "NumberOfBrokerNodes": 3, "BrokerNodeGroupInfo": { "InstanceType": "kafka.m5.large", "ClientSubnets": [ "ReplaceWithSubnetId1", "ReplaceWithSubnetId2", "ReplaceWithSubnetId3" ] } } } } } ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="13" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "MSK Cluster with required properties.", "Resources": { "TestCluster10": { "Type": "AWS::MSK::Cluster", "Properties": { "ClusterName": "ClusterWithRequiredProperties", "KafkaVersion": "2.2.1", "LoggingInfo": { "BrokerLogs": { "CloudWatchLogs": { "Enabled": false, "LogGroup": "awscloudwatchlog_group.test.name" } } }, "NumberOfBrokerNodes": 3, "BrokerNodeGroupInfo": { "InstanceType": "kafka.m5.large", "ClientSubnets": [ "ReplaceWithSubnetId1", "ReplaceWithSubnetId2", "ReplaceWithSubnetId3" ] } } } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: MSK Cluster with required properties. Resources: TestCluster: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: true LogGroup: awscloudwatchlog_group.test.name NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: ReplaceWithSubnetId1 ReplaceWithSubnetId2 ReplaceWithSubnetId3 ``` ```yaml title="Negative test num. 2 - yaml file" AWSTemplateFormatVersion: "2010-09-09" Description: MSK Cluster with required properties. Resources: TestCluster2: Type: 'AWS::MSK::Cluster' Properties: ClusterName: ClusterWithRequiredProperties KafkaVersion: 2.2.1 LoggingInfo: BrokerLogs: CloudWatchLogs: Enabled: false LogGroup: awscloudwatchlog_group.test.name S3: Enabled: true LogGroup: s3.test.name NumberOfBrokerNodes: 3 BrokerNodeGroupInfo: InstanceType: kafka.m5.large ClientSubnets: ReplaceWithSubnetId1 ReplaceWithSubnetId2 ReplaceWithSubnetId3 ``` ```json title="Negative test num. 3 - json file" { "AWSTemplateFormatVersion": "2010-09-09", "Description": "MSK Cluster with required properties.", "Resources": { "TestCluster3": { "Type": "AWS::MSK::Cluster", "Properties": { "ClusterName": "ClusterWithRequiredProperties", "KafkaVersion": "2.2.1", "LoggingInfo": { "BrokerLogs": { "CloudWatchLogs": { "Enabled": true, "LogGroup": "awscloudwatchlog_group.test.name" } } }, "NumberOfBrokerNodes": 3, "BrokerNodeGroupInfo": { "InstanceType": "kafka.m5.large", "ClientSubnets": [ "ReplaceWithSubnetId1", "ReplaceWithSubnetId2", "ReplaceWithSubnetId3" ] } } } } } ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "AWSTemplateFormatVersion": "2010-09-09", "Description": "MSK Cluster with required properties.", "Resources": { "TestCluster4": { "Type": "AWS::MSK::Cluster", "Properties": { "ClusterName": "ClusterWithRequiredProperties", "KafkaVersion": "2.2.1", "LoggingInfo": { "BrokerLogs": { "CloudWatchLogs": { "Enabled": false, "LogGroup": "awscloudwatchlog_group.test.name" }, "S3": { "Enabled": true, "LogGroup": "s3.test.name" } } }, "NumberOfBrokerNodes": 3, "BrokerNodeGroupInfo": { "InstanceType": "kafka.m5.large", "ClientSubnets": [ "ReplaceWithSubnetId1", "ReplaceWithSubnetId2", "ReplaceWithSubnetId3" ] } } } } } ``` </details>