Amazon MSK cluster logging is not enabled misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AWS_80
Category - Subcategory	Logging - Disabled or missing
Provider	AWS
Severity	MEDIUM
Framework	CloudFormation, Terraform, Terraform Plan

Impact

Amazon MSK enables you to build and run applications that use Apache Kafka to process streaming data. It also provides a control-plane for advanced operations, for example, creating, updating, and deleting clusters. Consistent cluster logging helps you determine if a request was made with root or AWS Identity and Access Management (IAM) user credentials and whether the request was made with temporary security credentials for a role or federated user.

How to Fix

Resource: AWS::MSK::Cluster

• Argument: LoggingInfo. Configure your MSK cluster to send broker logs to different destination types. This is a container for the configuration details related to broker logs. [source,go]

---

{ "Type" : "AWS::MSK::Cluster", "Properties" : { ...

• "LoggingInfo" : {
• "BrokerLogs" : {
• "CloudWatchLogs" : CloudWatchLogs,
• "Firehose" : Firehose,
• "S3" : S3 } } } }

---