AWS eventbridge: Document required VPC endpoints for MSK pipes in isolated subnets

Service: eventbridge · 2026-09-30 · Documentation medium

File: eventbridge/latest/userguide/eb-pipes-msk.md · Type: network

Summary

Adds guidance that when an Amazon MSK cluster runs in a fully isolated private subnet (no internet/NAT gateway), EventBridge requires interface VPC endpoints for lambda, sts, secretsmanager (for SASL/SCRAM or mTLS secret retrieval), and kms (for customer managed key decryption), in addition to pipes-data.

Security assessment

The added text documents network and encryption prerequisites (interface VPC endpoints for Secrets Manager and KMS) needed for EventBridge to reach an MSK cluster in an isolated subnet. It is hardening/configuration guidance with security impact (secret-based auth, KMS decryption) but does not address a specific vulnerability or incident.

Evidence

+    * `com.amazonaws.`region`.secretsmanager` – required when your cluster uses secret-based authentication, such as SASL/SCRAM or mTLS, so that EventBridge can retrieve the secret from Secrets Manager.

Diff

diff --git a/eventbridge/latest/userguide/eb-pipes-msk.md b/eventbridge/latest/userguide/eb-pipes-msk.md
index 80dbab2..4a5d57f 100644
--- a//eventbridge/latest/userguide/eb-pipes-msk.md
+++ b//eventbridge/latest/userguide/eb-pipes-msk.md
@@ -240,0 +241,10 @@ To set up a VPC endpoint, see [Create a VPC endpoint](https://docs.aws.amazon.co
+If your Amazon MSK cluster runs in a fully isolated private subnet, EventBridge reaches the cluster and the services it depends on only through interface VPC endpoints. This applies when the subnet has no internet gateway and no NAT gateway. In this case, create interface VPC endpoints for the following services in addition to `pipes-data`:
+
+    * `com.amazonaws.`region`.lambda` – always required.
+
+    * `com.amazonaws.`region`.sts` – always required.
+
+    * `com.amazonaws.`region`.secretsmanager` – required when your cluster uses secret-based authentication, such as SASL/SCRAM or mTLS, so that EventBridge can retrieve the secret from Secrets Manager.
+
+    * `com.amazonaws.`region`.kms` – required when the pipe uses a customer managed key, so that EventBridge can decrypt that key.
+