Amazon MSK now supports TLS 1.3 for data in transit

Amazon MSK TLS 1.3 Support

Amazon MSK now supports version 1.3 of the Transport Layer Security (TLS) protocol for MSK Provisioned clusters through encryption policies. TLS 1.3 delivers faster, more secure encryption for streaming data and is increasingly required by compliance frameworks and enterprise security standards.

Customers can opt in to TLS 1.3 by selecting a named security policy in their MSK cluster configuration, with no change to existing clusters until a policy is applied. A named security policy defines which TLS version and cipher suites a cluster can accept. With this launch, Amazon MSK provides a set of policies customers can select and any connection that does not meet the selected policy requirements is rejected. This allows customers to stay in control of their security and compliance posture.

What to do

• Select a named security policy in your MSK cluster configuration to opt in to TLS 1.3.
• Choose policies that support both TLS 1.2 and TLS 1.3 to allow clients that support TLS 1.3 to connect immediately while clients on TLS 1.2 continue to connect on TLS 1.2.
• Select stricter policies that align with your compliance requirements to restrict connections to TLS 1.3 only.

This capability is available at no additional cost in all AWS Regions where Amazon MSK Provisioned is available. To learn more, see the Amazon MSK documentation.

If you need further guidance on AWS, our experts are available at AWS@westloop.io. You may also reach us by submitting the Contact Us form.