MSK Data Volume CMK Missing
msk-data-volume-cmk-missing
What this rule checks
Detects MSK clusters whose broker volumes are not encrypted with a customer-managed KMS key.
How to fix it
- 1Set EncryptionInfo.EncryptionAtRest.DataVolumeKMSKeyId to a customer-managed key
CDK Insights pinpoints the exact file and line in your CDK source for every finding, so you can jump straight to the fix.
Affected resource types
AWS::MSK::ClusterIntentional? Suppress this finding
Sometimes a flag is deliberate — a genuinely public endpoint, say. You can dismiss msk-data-volume-cmk-missing and the reason is kept in the report, not silently hidden.
In .cdk-insights.json:
{
"ignoreRules": [
{ "id": "msk-data-volume-cmk-missing", "reason": "Why this is intentional" }
]
}Or inline in your CDK code:
Validations.of(scope).acknowledge({
id: 'cdk-insights::msk-data-volume-cmk-missing',
reason: 'Why this is intentional',
});Use the rule ID msk-data-volume-cmk-missing shown above — not the CDK-* ID from SARIF / GitHub code scanning. To dismiss every finding on one construct instead, use ignorePaths. Suppression docs →
Catch this in your stack
$ npx cdk-insights scanCDK Insights runs this and 126+ other rules locally against your synthesised CDK app — free, no account, your code never leaves your machine.