> **Experimental**
>
> `@aws-cdk/aws-msk-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# ClientBrokerEncryption

Indicates the encryption setting for data in transit between clients and brokers.

- Stability: [Experimental](/cdk/api/stability.html)
- Source: [`lib/cluster.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0-alpha.0/packages/@aws-cdk/aws-msk-alpha/lib/cluster.ts#L345)

## Example

```ts
import * as acmpca from 'aws-cdk-lib/aws-acmpca';

declare const vpc: ec2.Vpc;
const cluster = new msk.Cluster(this, 'Cluster', {
  clusterName: 'myCluster',
  kafkaVersion: msk.KafkaVersion.V4_1_X_KRAFT,
  vpc,
  encryptionInTransit: {
    clientBroker: msk.ClientBrokerEncryption.TLS,
  },
  clientAuthentication: msk.ClientAuthentication.tls({
    certificateAuthorities: [
      acmpca.CertificateAuthority.fromCertificateAuthorityArn(
        this,
        'CertificateAuthority',
        'arn:aws:acm-pca:us-west-2:1234567890:certificate-authority/11111111-1111-1111-1111-111111111111',
      ),
    ],
  }),
});
```

## Members

| Member | Description |
| --- | --- |
| `TLS` | TLS means that client-broker communication is enabled with TLS only. |
| `TLS_PLAINTEXT` | TLS_PLAINTEXT means that client-broker communication is enabled for both TLS-encrypted, as well as plaintext data. |
| `PLAINTEXT` | PLAINTEXT means that client-broker communication is enabled in plaintext only. |

## Referenced by

- [`EncryptionInTransitConfig`](/v2/docs/@aws-cdk_aws-msk-alpha.EncryptionInTransitConfig).clientBroker