KafkaCtl with AWS MSK and IAM auth

[Joel-PeakMetrics]

Hello,

I'd like to use KafkaCtl with AWS MSK. The MSK cluster is currently enabled with IAM auth only. Is there a way to enable kafkactl to use IAM SASL auth?

This configuration is working for the kafka java commands:

security.protocol=SASL_SSL
sasl.mechanism=AWS_MSK_IAM
sasl.jaas.config=software.amazon.msk.auth.iam.IAMLoginModule required;
sasl.client.callback.handler.class=software.amazon.msk.auth.iam.IAMClientCallbackHandler

Thanks for your help!

[d-rk]

Hi @Joel-PeakMetrics

that is currently not possible. There is an open issue (and a related PR) in the kafka library we use:
IBM/sarama#1985

When something happens with that issue we can look into this again.

Regards

[alahijani]

@d-rk The IBM/sarama issue is now closed.

[d-rk]

It should now be possible to implement this using: https://github.com/aws/aws-msk-iam-sasl-signer-go

[KeisukeYamashita]

Hi @d-rk, apologies for the interruption.

I've submitted a PR to implement a feature that eliminates the need for static ID/PWDs, making this tool even more useful for AWS MSK users: deviceinsight/kafkactl-plugins#1.
It worked perfectly on our AWS MSK cluster with IAM access control enabled.

Please take a look when you have a moment. Thank you!

[KeisukeYamashita]

@d-rk I hope this message finds you well.

If adding it upstream is challenging, no worries; since it’s a plugin, I can close the PR and offer it independently so that AWS MSK users can securely access their cluster in a keyless manner. Nonetheless, I would appreciate your thoughts on it.

Thanks in advance for your time and feedback.

[d-rk]

Hey @KeisukeYamashita thank you for the PR.
Implementing the AWS plugin is on my list since I introduced the plugin system, so I'm glad that you helped me out here :)
Hopefully next week I will find time to review it.

Regards, Dirk