Posted On: Jul 9, 2021
Today we announced Amazon Identity and Access Management (IAM) Access Control for Amazon MSK. IAM Access Control is a security option offered at no additional cost that simplifies cluster authentication and Apache Kafka API authorization using IAM role or user policies to control access. By using IAM Access Control, customers no longer need to build and run one-off access management systems to control client authentication and authorization for Apache Kafka, and MSK clusters are secured using least privileged permissions by default.
In a few clicks, customers can enable IAM Access Control during the MSK cluster creation step. Next, they define IAM polices for users and roles to control the identities that may access an MSK cluster and control the actions these clients can take on Apache Kafka APIs. For example, customers can write an IAM policy to control which clients may connect to clusters, and write to or read from Apache Kafka topics. This eliminates the need to use an unfamiliar authentication or authorization system just for Apache Kafka. All clients need to be configured with the Apache 2.0 licensed msk-iam-auth library which infers and sends IAM credentials securely to MSK using SigV4 request signing.
MSK’s integration with IAM supports standard IAM features including tag, condition keys, user, and role based access control, support for external identity providers including OpenID Connect for OAuthBearer authentication. IAM Access Control is available for new MSK clusters in Amazon Web Services China (Beijing) Region, operated by Sinnet, and Amazon Web Services China (Ningxia) Region, operated by NWCD.
Visit the MSK user documentation to get started.