---
title: "Ensure MSK cluster encryption at rest and in transit is enabled"
canonical: "https://kb.cynergy.app/space/MD/991855117/Ensure%20MSK%20cluster%20encryption%20at%20rest%20and%20in%20transit%20is%20enabled"
format: markdown
---
Cynergy Policy ID: CYN_AWS_GENERAL_32  
Severity: MEDIUM

# MSK cluster encryption at rest and in transit is not enabled

# Description

Amazon MSK integrates with AWS Key Management Service (KMS) for server-side encryption. When you create an MSK cluster, you can specify the AWS KMS CMK for Amazon MSK to use to encrypt your data at rest. If you don't specify a CMK, Amazon MSK creates an AWS-managed CMK for you and uses it on your behalf.

We recommend using encryption in transit and at rest to secure your managed Kafka queue.

# Fix - Runtime

## CLI Command

Run the create-cluster command and use the encryption-info option to point to the file where you saved your configuration JSON.

Shell

```shell
aws kafka create-cluster
--cluster-name "ExampleClusterName"
--broker-node-group-info file://brokernodegroupinfo.json
--encryption-info file://encryptioninfo.json
--kafka-version "2.2.1"
--number-of-broker-nodes 3

```

# Fix - Buildtime

## Terraform

- **Resource:** aws_msk_cluster
- **Arguments:** encryption_info - (Optional) Configuration block for specifying encryption.  
encryption_in_transit - (Optional) Configuration block to specify encryption in transit. See below.

Go

```go
resource "aws_msk_cluster" "example" {
  cluster_name           = "example"
  ...
	+ encryption_info {
  +    encryption_at_rest_kms_key_arn = aws_kms_key.kms.arn
  +   
	+    encryption_in_transit {
	+        client_broker = "TLS"
	+        in_cluster    = true 
  +     }
  + }
  ...
}

```