AWS msk high security documentation change

Service: msk · 2025-04-03 · Security-related high

File: msk/latest/developerguide/msk-replicator-requirements.md

Summary

Updated IAM policy example with granular permissions including specific resource ARNs, added iam:PassRole and iam:CreateServiceLinkedRole actions with conditions, and removed wildcard resources

Security assessment

The changes enforce least-privilege permissions by replacing wildcard resources with specific ARNs and adding required IAM actions with service-linked role constraints. This directly addresses potential over-permission security risks in Replicator configurations.

Diff

diff --git a/msk/latest/developerguide/msk-replicator-requirements.md b/msk/latest/developerguide/msk-replicator-requirements.md
index 161adacc2..2abc2b23e 100644
--- a//msk/latest/developerguide/msk-replicator-requirements.md
+++ b//msk/latest/developerguide/msk-replicator-requirements.md
@@ -13 +13 @@ The following sections give an overview of the prerequisites, supported configur
-Here is an example of the IAM policy required to create an MSK Replicator. The action `kafka:TagResource` is only needed if tags are provided when creating the MSK Replicator. Replicator IAM policies should be attached to the IAM role that corresponds to your client. For information on creating authorization policies, see [Create authorization policies](https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#create-iam-access-control-policies).
+Here is an example of the IAM policy required to create an MSK Replicator. The action `kafka:TagResource` is only needed if tags are provided when creating the MSK Replicator. Replicator IAM policies should be attached to the IAM role that corresponds to your client. For information about creating authorization policies, see [Create authorization policies](https://docs.aws.amazon.com/msk/latest/developerguide/iam-access-control.html#create-iam-access-control-policies).
@@ -20 +20,18 @@ Here is an example of the IAM policy required to create an MSK Replicator. The a
-                "Sid": "VisualEditor1",
+          "Sid": "MSKReplicatorIAMPassRole",
+          "Effect": "Allow",
+          "Action": "iam:PassRole",
+          "Resource": "arn:aws:iam::123456789012:role/MSKReplicationRole",
+          "Condition": {
+            "StringEquals": {
+              "iam:PassedToService": "kafka.amazonaws.com"
+            }
+          }
+        },
+        {
+          "Sid": "MSKReplicatorServiceLinkedRole",
+          "Effect": "Allow",
+          "Action": "iam:CreateServiceLinkedRole",
+          "Resource": "arn:aws:iam::123456789012:role/aws-service-role/kafka.amazonaws.com/AWSServiceRoleForKafka*"
+        },
+        {
+          "Sid": "MSKReplicatorEC2Actions",
@@ -23,2 +39,0 @@ Here is an example of the IAM policy required to create an MSK Replicator. The a
-                    "iam:PassRole",
-                    "iam:CreateServiceLinkedRole",
@@ -27 +41,0 @@ Here is an example of the IAM policy required to create an MSK Replicator. The a
-                    "ec2:CreateNetworkInterface",
@@ -28,0 +43,13 @@ Here is an example of the IAM policy required to create an MSK Replicator. The a
+            "ec2:CreateNetworkInterface"
+          ],
+          "Resource": [
+            "arn:aws:ec2:us-east-1:123456789012:subnet/subnet-0abcd1234ef56789",
+            "arn:aws:ec2:us-east-1:123456789012:security-group/sg-0123abcd4567ef89",
+            "arn:aws:ec2:us-east-1:123456789012:network-interface/eni-0a1b2c3d4e5f67890",
+            "arn:aws:ec2:us-east-1:123456789012:vpc/vpc-0a1b2c3d4e5f67890"
+          ]
+        },
+        {
+          "Sid": "MSKReplicatorActions",
+          "Effect": "Allow",
+          "Action": [
@@ -32 +59,4 @@ Here is an example of the IAM policy required to create an MSK Replicator. The a
-                "Resource": "*"
+          "Resource": [
+            "arn:aws:kafka:us-east-1:123456789012:cluster/myCluster/abcd1234-56ef-78gh-90ij-klmnopqrstuv",
+            "arn:aws:kafka:us-east-1:123456789012:replicator/myReplicator/wxyz9876-54vu-32ts-10rq-ponmlkjihgfe"
+          ]