Amazon MQ Adds Mutual TLS Authentication for RabbitMQ Brokers

Amazon MQ is tightening security with X.509 certificate-based authentication, but will developers actually configure it?

Amazon MQ now supports X.509 client certificate authentication with mutual TLS (mTLS) for RabbitMQ brokers. This feature requires RabbitMQ version 4.2 and above on Amazon MQ.

Configuration involves editing the RabbitMQ auth_mechanism_ssl plugin in the broker's configuration file. The feature is available via AWS Management Console, CLI, or SDKs when creating new brokers with the M7g instance type. The plugin is supported in all regions where Amazon MQ RabbitMQ 4 instances are available.

Unlike traditional credential-based authentication methods, certificate-based authentication relies on cryptographic keys and digital certificates to verify identity. For example, developers must generate a Certificate Authority (CA) and issue client certificates signed by it.

These certificates are then uploaded to the Amazon MQ broker and referenced in the auth_mechanism_ssl plugin configuration. This workflow eliminates the need for username/password pairs but introduces certificate management overhead.