Using clear-text protocols exposes data in transit to eavesdropping and man-in-the-middle attacks.

Why is this an issue?

An attacker who can observe network traffic — for example through a compromised network device, a position on the same network segment, or a cloud environment breach — can read, modify, or inject data sent over ftp, telnet, http, or unencrypted SMTP without detection. This is true even on internal or isolated networks, where insider threats or lateral movement after an initial compromise can expose unencrypted traffic. This rule raises an issue when a clear-text protocol scheme is used or when encryption is explicitly disabled for a network connection.

What is the potential impact?

Sensitive data exposure

An attacker who can intercept network traffic can read all data transmitted over clear-text connections, including credentials, session tokens, API keys, or personal data.

Data tampering

Because clear-text protocols provide no integrity protection, an attacker in a man-in-the-middle position can silently modify data in transit — redirecting users to malicious endpoints, injecting malicious content into responses, or altering commands sent to remote services.

How to fix it in AWS Kinesis

Code examples

The following code uses a clear-text protocol or disables encryption for a network connection, leaving transmitted data exposed to interception.

Noncompliant code example

AWSTemplateFormatVersion: 2010-09-09
Resources:
  KinesisStream: # Noncompliant
    Type: AWS::Kinesis::Stream
    Properties:
      ShardCount: 1
      # No StreamEncryption

Compliant solution

AWSTemplateFormatVersion: 2010-09-09
Resources:
  KinesisStream:
    Type: AWS::Kinesis::Stream
    Properties:
      ShardCount: 1
      StreamEncryption:
         EncryptionType: KMS

How to fix it in Amazon ElastiCache

Code examples

The following code uses a clear-text protocol or disables encryption for a network connection, leaving transmitted data exposed to interception.

Noncompliant code example

AWSTemplateFormatVersion: 2010-09-09
Resources:
  Example:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupId: "example"
      TransitEncryptionEnabled: false  # Noncompliant

Compliant solution

AWSTemplateFormatVersion: 2010-09-09
Resources:
  Example:
    Type: AWS::ElastiCache::ReplicationGroup
    Properties:
      ReplicationGroupId: "example"
      TransitEncryptionEnabled: true

How to fix it in Amazon ECS

Code examples

The following code uses a clear-text protocol or disables encryption for a network connection, leaving transmitted data exposed to interception.

Noncompliant code example

AWSTemplateFormatVersion: 2010-09-09
Resources:
  EcsTask:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: "service"
      Volumes:
        -
          Name: "storage"
          EFSVolumeConfiguration:
            FilesystemId: !Ref FS
            TransitEncryption: "DISABLED"  # Noncompliant

Compliant solution

AWSTemplateFormatVersion: 2010-09-09
Resources:
  EcsTask:
    Type: AWS::ECS::TaskDefinition
    Properties:
      Family: "service"
      Volumes:
        -
          Name: "storage"
          EFSVolumeConfiguration:
            FilesystemId: !Ref FS
            TransitEncryption: "ENABLED"

How to fix it in AWS Elastic Load Balancing

Code examples

The following code uses a clear-text protocol or disables encryption for a network connection, leaving transmitted data exposed to interception.

Noncompliant code example

AWSTemplateFormatVersion: 2010-09-09
Resources:
  HTTPlistener:
   Type: "AWS::ElasticLoadBalancingV2::Listener"
   Properties:
     DefaultActions:
       - Type: "redirect"
         RedirectConfig:
           Protocol: "HTTP" # Noncompliant
     Protocol: "HTTP" # Noncompliant

Compliant solution

AWSTemplateFormatVersion: 2010-09-09
Resources:
  HTTPlistener:
   Type: "AWS::ElasticLoadBalancingV2::Listener"
   Properties:
     DefaultActions:
       - Type: "redirect"
         RedirectConfig:
           Protocol: "HTTPS"
     Protocol: "HTTPS"

How to fix it in AWS OpenSearch

Code examples

The following code uses a clear-text protocol or disables encryption for a network connection, leaving transmitted data exposed to interception.

Noncompliant code example

AWSTemplateFormatVersion: 2010-09-09
Resources:
  Example:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: example
      DomainEndpointOptions:
        EnforceHTTPS: false # Noncompliant
      NodeToNodeEncryptionOptions:
        Enabled: false # Noncompliant

Compliant solution

AWSTemplateFormatVersion: 2010-09-09
Resources:
  Example:
    Type: AWS::OpenSearchService::Domain
    Properties:
      DomainName: example
      DomainEndpointOptions:
        EnforceHTTPS: true
      NodeToNodeEncryptionOptions:
        Enabled: true

How to fix it in Amazon MSK

Code examples

The following code uses a clear-text protocol or disables encryption for a network connection, leaving transmitted data exposed to interception.

Noncompliant code example

AWSTemplateFormatVersion: 2010-09-09
Resources:
  MSKCluster:
    Type: 'AWS::MSK::Cluster'
    Properties:
      ClusterName: MSKCluster
      EncryptionInfo:
        EncryptionInTransit:
          ClientBroker: TLS_PLAINTEXT # Noncompliant
          InCluster: false # Noncompliant

Compliant solution

AWSTemplateFormatVersion: 2010-09-09
Resources:
  MSKCluster:
    Type: 'AWS::MSK::Cluster'
    Properties:
      ClusterName: MSKCluster
      EncryptionInfo:
        EncryptionInTransit:
          ClientBroker: TLS
          InCluster: true

Amazon MSK encrypts data in transit by default, allowing you to omit the EncryptionInTransit configuration entirely.

Resources

Documentation

Articles & blog posts

Standards