1. Sign in to the AWS Management Console:
   • Go to the AWS Management Console at https://aws.amazon.com/console/.
2. Navigate to the Amazon RDS Console:
   • Click on the “Services” dropdown menu at the top left corner.
   • Under the “Database” section, click on “RDS”.
3. Select the RDS Instance:
   • In the Amazon RDS dashboard, select the RDS instance that you want to enable encryption in transit for.
4. Modify the RDS Instance:
   • Click on the checkbox next to the RDS instance you selected.
   • Click on the “Modify” button at the top.
5. Enable Encryption in Transit:
   • Scroll down to the “Network & Security” section.
   • Under the “Additional configuration” heading, look for the “Encryption” option.
   • Select the option for “Encryption in transit”.
   • Choose the appropriate encryption type (SSL/TLS) from the dropdown menu.
6. Save the Changes:
   • Scroll to the bottom of the page and click on the “Continue” button.
   • Review the changes you are about to make.
   • Click on the “Modify DB Instance” button to apply the changes.
7. Monitor the Modification Progress:
   • Wait for the modification process to complete. This may take a few minutes.
   • You can monitor the progress in the RDS dashboard or through the “Modify” option.
8. Verify Encryption in Transit:
   • Once the modification is complete, verify that encryption in transit is enabled for the RDS instance.
   • You can check the encryption status in the RDS console or by connecting to the RDS instance and checking the encryption settings.

​

1. Open the AWS CLI and run the following command to enable encryption in transit for the MSK cluster:

aws rds modify-db-cluster --db-cluster-identifier your-db-cluster-name --enable-http-endpoint --apply-immediately

2. Wait for the modification to be completed. You can check the status of the modification by running the following command:

aws rds describe-db-clusters --db-cluster-identifier your-db-cluster-name --query 'DBClusters[0].Endpoint'

3. Once the modification is completed, verify that encryption in transit is enabled for the MSK cluster by running the following command:

aws rds describe-db-clusters --db-cluster-identifier your-db-cluster-name --query 'DBClusters[0].Endpoint'

1. Import the necessary libraries:

import boto3

2. Initialize the AWS RDS client:

rds_client = boto3.client('rds')

3. Get a list of all RDS instances:

response = rds_client.describe_db_instances()

4. Iterate through each RDS instance and enable encryption in transit for MSK Cluster:

for db_instance in response['DBInstances']:
    db_instance_identifier = db_instance['DBInstanceIdentifier']
    
    # Modify the DB instance to enable encryption in transit for MSK Cluster
    rds_client.modify_db_instance(
        DBInstanceIdentifier=db_instance_identifier,
        MSKClusterEncryption={'Enabled': True}
    )

5. Verify that encryption in transit for MSK Cluster is enabled by checking the DB instance details:

response = rds_client.describe_db_instances(DBInstanceIdentifier=db_instance_identifier)
msk_cluster_encryption = response['DBInstances'][0]['MSKClusterEncryption']

if msk_cluster_encryption['Status'] == 'enabled':
    print(f"Encryption in transit for MSK Cluster is successfully enabled for RDS instance: {db_instance_identifier}")
else:
    print(f"Failed to enable encryption in transit for MSK Cluster for RDS instance: {db_instance_identifier}")

resource "aws_msk_cluster" "THIS_MSK_CLUSTER" {
  cluster_name           = "REPLACE_WITH_CLUSTER_NAME"
  kafka_version          = "REPLACE_WITH_KAFKA_VERSION"
  number_of_broker_nodes = REPLACE_WITH_BROKER_NODE_COUNT

  broker_node_group_info {
    instance_type   = "REPLACE_WITH_INSTANCE_TYPE"
    client_subnets  = [REPLACE_WITH_SUBNET_IDS]
    security_groups = [REPLACE_WITH_SG_IDS]
  }

  encryption_info {
    encryption_in_transit {
      # This must be true to require TLS for in-cluster broker node connections
      in_cluster = true

      # Optionally also enforce TLS for client-to-broker traffic:
      # client_broker = "TLS"   # or "TLS_PLAINTEXT" / "PLAINTEXT" per your policy
    }

    # Other encryption settings as needed, for example:
    # encryption_at_rest_kms_key_arn = "REPLACE_WITH_KMS_KEY_ARN"
  }

  # ...any other required arguments (monitoring, logging, tags, etc.)
}

• THIS_MSK_CLUSTER with your Terraform resource name.
• REPLACE_WITH_CLUSTER_NAME with the MSK cluster name.
• REPLACE_WITH_KAFKA_VERSION with a valid Kafka version (e.g., "3.6.0").
• REPLACE_WITH_BROKER_NODE_COUNT with the desired integer node count.
• REPLACE_WITH_INSTANCE_TYPE with a supported broker instance type.
• REPLACE_WITH_SUBNET_IDS with a list of subnet IDs.
• REPLACE_WITH_SG_IDS with a list of security group IDs.
• Optionally REPLACE_WITH_KMS_KEY_ARN with a KMS key ARN if using encryption at rest.

• encryption_info.0.encryption_in_transit.0.in_cluster changing to true on the MSK cluster.
• A resource replacement if the cluster previously had in_cluster = false or omitted.