Amazon MSK now supports TLS 1.3 for data in transit

Amazon MSK now supports TLS version 1.3 for provisioned clusters, enhancing speed and security for encrypted streaming data and meeting evolving compliance and corporate security standards. It also serves as a prerequisite for post-quantum encryption to protect data against quantum computer attacks. Customers can enable TLS 1.3 by selecting a named security policy in their MSK cluster settings. Existing clusters will not change until the policy is applied. Named security policies define the TLS versions and cipher suites the cluster accepts, allowing customers to control security and compliance. Policies supporting both TLS 1.2 and TLS 1.3 let clients negotiate the highest supported version, enabling TLS 1.3-capable clients to connect immediately while TLS 1.2 clients continue using TLS 1.2, allowing customers to upgrade clients before enforcing stricter policies. Customers can also choose a policy that restricts connections to TLS 1.3 only, aligning with compliance requirements. This feature is available at no additional cost in all AWS regions where Amazon MSK provisioning is offered. For more information, see the Amazon MSK documentation.

Why it matters

Amazon MSK is a managed Kafka service. This update enhances security for data in transit, making it particularly useful for enterprises with high compliance and security requirements.