message-bus-security

Message Bus Security

Message buses (NATS, RabbitMQ, Kafka, MQTT, AWS SQS/SNS, GCP Pub/Sub) are the connective tissue of distributed systems. They're also the most under-audited part of most architectures — by the time the audit gets to "what's on the bus and who can see it", the team has often been on the system for years without revisiting.

This skill is the per-bus and cross-bus checklist. Pairs with distributed-system-audit (system-level audit), agent-client-security (when agents are producers/consumers).

When to invoke

• Introducing a message bus to a new architecture
• Adding multi-tenancy to an existing bus
• After an incident involving cross-tenant leakage, replay, or denial-of-service via the bus
• Auditing a system that uses a bus, especially distributed-agent / IoT / worker-pool architectures
• Periodic review (annually for production buses)

The model

For each bus, you're checking:

1. Authentication — who can connect at all
2. Authorization — who can publish where, who can subscribe to what
3. Tenancy — can tenant A see tenant B's messages, ever
4. Confidentiality — in-transit + at-rest encryption
5. Integrity / replay — can a captured message be re-sent or forged
6. Reliability semantics — exactly-once / at-least-once / at-most-once, and does the application correctly handle the chosen mode
7. Audit — when something happens, can you tell who did it

Each bus implements these differently. Below: the common patterns plus per-bus specifics for the three that dominate small/medium-team setups.

NATS

Authentication

NATS has several auth options:

• NKEYs + signed nonces (Ed25519 key-pair per client). Standard for production.
• JWT-based auth (account hierarchy with signed JWTs). Standard for multi-tenant.
• Username/password — for dev only
• TLS client certs — supported; rarely needed when NKEYs are in use

Production pattern: Operator → Accounts → Users. The Operator signs Account JWTs; each Account signs User JWTs. Each User has an NKEY and presents JWT + signed nonce on connect. Revocation is built into the JWT model.