BrokerSecurity

Kafka's connection security protocols specifically: PLAINTEXT, SSL, SASL_PLAINTEXT, SASL_SSL — each a different TLS/SASL combination for broker connections.

Why we need this / what value this brings

An unauthenticated or unencrypted broker connection means anyone on the network can read or inject messages.

When to use this

Any time a message broker (Kafka, RabbitMQ) is deployed anywhere other than a fully isolated, trusted private network.

How to use or implement this

Use SASL_SSL (both auth and encryption) for anything not entirely within a locked-down VPC; PLAINTEXT only for local dev.

Research questions

• Why is PLAINTEXT only acceptable inside a trusted private network, never over the public internet?
• SASL_SSL vs mTLS — when would you need both auth and encryption vs just encryption?

---

Empty folder — drop notes, links, and findings here as you research.