A Message Queue for Apache Kafka instance is Compliant if its whitelists do not include 0.0.0.0/0.
Scenarios
Adding 0.0.0.0/0 to a Message Queue for Apache Kafka instance whitelist allows access from all IP addresses, posing significant security risks.
Risk level
Default risk level: high.
You can change the risk level based on your business requirements.
Compliance evaluation logic
- If 0.0.0.0/0 is not in the whitelists of the Message Queue for Apache Kafka instance, the result is Compliant.
- If 0.0.0.0/0 is in a whitelist of the Message Queue for Apache Kafka instance, the result is Incompliant. Resolve this by following Incompliance remediation.
Rule details
| Item | Description |
| Rule name | kafka-instance-public-access-check |
| Rule identifier | kafka-instance-public-access-check |
| Tag | Kafka and Instance |
| Automatic remediation | Not supported |
| Trigger type | Periodic execution |
| Evaluation frequency | Every 24 hours |
| Supported resource type | Message Queue for Apache Kafka instances |
| Input parameter | None |
Incompliance remediation
Delete 0.0.0.0/0 from all whitelists of Message Queue for Apache Kafka instances. For more information, see Configure whitelists.