Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- Amazon MSK announced TLS 1.3 policies for Provisioned clusters on October 30, 2026; a policy covers every encrypted link managed by MSK. AWS says the capability adds no feature charge in Regions where MSK Provisioned is available, but the service and related resources are not free.
- MSK-TLS1.2-Default-2026 accepts only TLS 1.2; MSK-TLSv1.3-2026 accepts both TLS 1.2 and 1.3; and MSK-TLSv1.3-Only-2026 accepts only TLS 1.3.
- The mixed policy retains TLS 1.2 cipher suites, but a client that advertises TLS 1.3 and then fails its handshake does not retry with TLS 1.2.
- Existing clusters can move only between adjacent policies. Check that the cluster is Provisioned, runs Kafka 3.6 or later, is ACTIVE with no operation in progress, and that you have the required configuration permissions. New clusters can start with TLS 1.3 only.
- Test clients and network intermediaries outside production first. Applying a policy triggers one rolling restart per broker; the documentation's conditions for continued service are limited and do not guarantee zero disruption.
Three policies define different protocol boundaries
On October 30, 2026, Amazon MSK announced named security policies that let Provisioned clusters use TLS 1.3. MSK-TLS1.2-Default-2026 accepts only TLS 1.2; MSK-TLSv1.3-2026 accepts both TLS 1.2 and 1.3; and MSK-TLSv1.3-Only-2026 accepts only TLS 1.3. TLS encrypts data in transit; these policies control its protocol versions and cipher suites.
A cluster without another policy set continues to use the default TLS 1.2 configuration; existing clusters do not change just because the capability launched. The announcement says the policies add no feature charge in AWS Regions where MSK Provisioned is available. This does not make MSK or related services free. Regional availability does not establish that access is enabled for a particular account; confirm account support separately.
The mixed policy does not recover a failed TLS 1.3 handshake
The mixed policy adds TLS 1.3 while retaining every TLS 1.2 cipher suite. A connection negotiates the highest version both sides support. If a client advertises TLS 1.3 but cannot complete a TLS 1.3 handshake, the connection fails; it does not fall back to TLS 1.2.
The TLS 1.3 policies support TLS_AES_128_GCM_SHA256 and TLS_AES_256_GCM_SHA384, but not TLS_CHACHA20_POLY1305_SHA256. A client that offers only that suite cannot complete a TLS 1.3 handshake. Also check client TLS libraries, their RFC 8446 implementation, and any proxy, firewall, load balancer, or traffic inspection device in the path.
The policy covers all encrypted links managed by MSK
A policy determines which TLS protocol versions and cipher suites Amazon MSK accepts. Its scope includes every encrypted link MSK manages, not only client-to-broker connections.
In KRaft mode, that also includes broker replication, broker-to-controller links, and the controller quorum. In ZooKeeper mode, it includes broker replication, broker-to-ZooKeeper links, and the ZooKeeper quorum. Include these internal links in the compatibility review, not just application clients.
Existing clusters must move one adjacent policy at a time
To set tls.security.policy, the cluster must be MSK Provisioned, run Apache Kafka 3.6 or later, be ACTIVE with no other operation in progress, and you must have permission to create or update an MSK configuration and update the cluster configuration. Apply the property through a configuration revision; there is no separate policy API. Set the property in server.properties, create or update the configuration revision, then apply that revision to the cluster; saving a configuration alone does not update the cluster.
An existing cluster can move only to an adjacent policy, and each update must complete before the next begins. To move from the default to TLS 1.3 only, apply the mixed policy first. A new cluster can select TLS 1.3 only directly. A new configuration revision replaces the current configuration, so preserve its other properties when adding the policy.
Test clients before scheduling a rolling restart
First, test the actual client libraries, tools, and network intermediaries on a non-production cluster. AWS recommends confirming that clients implement TLS 1.3 as specified by RFC 8446; some older implementations abort instead of negotiating the highest mutually supported version. A TLS 1.3-only policy rejects clients that cannot negotiate TLS 1.3.
Applying the configuration triggers a rolling restart, with each broker restarting once, so clients need to reconnect. AWS says the cluster continues serving during the restart when topic replication factor is at least 3, min.insync.replicas is no greater than replication factor minus 1, and clients retry. These conditions do not guarantee uninterrupted service for every cluster.
Rollback is also stepwise and changes client compatibility
If clients cannot connect after an update, move back to the previous policy in order. Moving from TLS 1.3 only to the mixed policy restores access for clients that support only TLS 1.2, but a client with a faulty TLS 1.3 implementation can still fail. Moving from the mixed policy to the default accepts only TLS 1.2, so TLS 1.3-only clients will fail.
Returning from TLS 1.3 only to the TLS 1.2 default takes two updates: apply the mixed policy and wait for it to complete before applying the default. On a TLS 1.3-only cluster, clearing the property requests a two-step change and is rejected. Before rollback, confirm the current policy, that the cluster is ACTIVE, and that no operation is in progress.
Sources
Frequently Asked Questions
Do these named policies also support MSK Serverless?
No. This TLS security policy capability applies only to MSK Provisioned. Do not apply this upgrade sequence to Serverless.
Does enabling TLS 1.3 mean post-quantum cryptography is enabled?
No. The announcement describes TLS 1.3 as a prerequisite for post-quantum cryptography. Selecting this policy alone does not establish that post-quantum cryptography is enabled on a cluster.
Can I use the Kafka admin API to change ssl.* properties on individual brokers?
Do not use that as a substitute for the MSK configuration. AWS warns that such overrides can conflict with MSK-managed settings and disrupt client connections and internal replication after a restart or patch update; recovery may require AWS Support. Use the named policies with their exact, case-sensitive identifiers.
What if the account reports that the configuration property is unsupported?
Remove tls.security.policy from the configuration and contact your AWS account team or AWS Support to request access. The documentation does not guarantee support for every account.