Encryption at rest in Kafka - Step-by-Step Execution

Process Flow - Encryption at rest

Data Written to Kafka

↓

Kafka Broker Receives Data

↓

Encrypt Data on Disk

↓

Store Encrypted Data

↓

Data at Rest is Encrypted

↓

Authorized Read Requests

↓

Decrypt Data Before Sending

↓

Send Plain Data to Consumer

Data sent to Kafka is encrypted before saving on disk and decrypted only when authorized consumers read it.

Execution Sample

Kafka

props.put("security.inter.broker.protocol", "SSL");
props.put("ssl.keystore.location", "/path/to/keystore.jks");
props.put("ssl.keystore.password", "password");
props.put("ssl.key.password", "password");
// Data is encrypted on disk using SSL keys

This code configures Kafka brokers to encrypt data in transit using SSL certificates.

Process Table

Step	Action	Data State	Result
1	Data sent to Kafka broker	Plain text	Data received by broker
2	Broker applies encryption	Encrypted	Data ready to store
3	Data stored on disk	Encrypted	Data saved securely
4	Consumer requests data	Encrypted	Broker prepares to decrypt
5	Broker decrypts data	Plain text	Data ready to send
6	Data sent to consumer	Plain text	Consumer receives readable data
7	End	Plain text	Process complete

💡 Process ends after data is decrypted and sent to authorized consumer.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	Final
data_state	Plain text	Encrypted	Encrypted	Plain text	Plain text

Key Moments - 3 Insights

Why is data encrypted before storing on disk?

Data is encrypted before storing (see Step 2 in execution_table) to protect it from unauthorized access if disk is compromised.

When does data become readable again?

Data is decrypted just before sending to the consumer (Step 5), so only authorized users see plain text.

Is data encrypted during transmission between client and broker?

Encryption at rest focuses on disk storage; transmission encryption uses SSL/TLS separately, not shown in this flow.

Visual Quiz - 3 Questions

Look at the execution_table, what is the data state after Step 3?

A Encrypted

B Plain text

C Decrypted

D Corrupted

💡 Hint

Check the 'Data State' column for Step 3 in the execution_table.

At which step does the broker decrypt the data?

A Step 4

B Step 5

C Step 2

D Step 6

💡 Hint

Look for the step where 'Broker decrypts data' in the 'Action' column.

If encryption was skipped, how would the 'data_state' variable change after Step 3?

A It would become 'Corrupted'

B It would become 'Encrypted'

C It would remain 'Plain text'

D It would be 'Decrypted'

💡 Hint

Refer to variable_tracker and consider what happens if encryption is not applied.

Concept Snapshot

Encryption at rest in Kafka means data is encrypted before saving on disk.
Kafka brokers use SSL keys to encrypt and decrypt data.
Data stays encrypted on disk to protect from unauthorized access.
Decryption happens only when authorized consumers read data.
This ensures data security even if storage is compromised.

Full Transcript

Encryption at rest in Kafka protects data by encrypting it before storing on disk. When data is sent to the Kafka broker, it is initially plain text. The broker encrypts the data before saving it to disk, so the stored data is secure. When a consumer requests the data, the broker decrypts it and sends the readable data to the consumer. This process ensures that data remains protected while stored and only authorized users can read it. The execution table shows each step from data reception, encryption, storage, decryption, and delivery. The variable tracker follows the data state changes from plain text to encrypted and back to plain text. Key moments clarify why encryption is done before storage and when data becomes readable again. The visual quiz tests understanding of these steps and data states.