Amazon MSK Now Supports TLS 1.3 with Selectable Security Policies at No Extra Cost

Hi everyone, it's Shii-chan! Encryption for MSK just took a step forward!

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced that Amazon MSK Provisioned clusters now support TLS 1.3 through encryption policies.

Why it matters

TLS 1.3 delivers faster, more secure encryption for streaming data, and compliance frameworks and enterprise security standards increasingly require it. It is also one of the prerequisites for post-quantum cryptography, which protects against attacks that collect encrypted traffic now to decrypt it later.

What changes

You opt in by selecting a named security policy in your MSK cluster configuration. Existing clusters don't change until a policy is applied.

Dive Deep

A named security policy defines which TLS version and cipher suites a cluster accepts. Any connection that doesn't meet the policy is rejected.

• Policies supporting both TLS 1.2 and 1.3: each connection negotiates the highest version the client supports. TLS 1.3 clients connect on 1.3 right away, while 1.2 clients keep using 1.2, so you can upgrade clients at your own pace
• Stricter TLS 1.3-only policies: restrict connections to TLS 1.3 to match tighter compliance requirements

There is no additional cost, and it's available in all Regions where MSK Provisioned is available. The announcement doesn't name the specific policies, so check the MSK documentation.

Wrap-up

• TLS 1.3 is available on MSK Provisioned
• Opt in with a named policy; existing clusters stay as they are
• Migrate step by step from 1.2/1.3 to 1.3 only
• No additional cost

A good fit for security teams chasing compliance and teams upgrading Kafka clients gradually!