AWS CDK Reference

Appearance

v2.275.0

Experimental

@aws-cdk/aws-msk-alpha is an experimental (alpha) package: its API may change in any release, without a major version bump.

SaslTlsAuthProps Struct ​

SASL + TLS authentication properties.

Stability
Experimental
Source
lib/cluster.ts

Example ​

ts
import * as acmpca from 'aws-cdk-lib/aws-acmpca';

declare const vpc: ec2.Vpc;
const cluster = new msk.Cluster(this, 'Cluster', {
  clusterName: 'myCluster',
  kafkaVersion: msk.KafkaVersion.V4_1_X_KRAFT,
  vpc,
  encryptionInTransit: {
    clientBroker: msk.ClientBrokerEncryption.TLS,
  },
  clientAuthentication: msk.ClientAuthentication.saslTls({
    iam: true,
    certificateAuthorities: [
      acmpca.CertificateAuthority.fromCertificateAuthorityArn(
        this,
        'CertificateAuthority',
        'arn:aws:acm-pca:us-west-2:1234567890:certificate-authority/11111111-1111-1111-1111-111111111111',
      ),
    ],
  }),
});

Properties ​

certificateAuthoritiesoptionalICertificateAuthority[]certificate_authoritiesoptionaltyping.List[ICertificateAuthority]certificateAuthoritiesoptionalList<ICertificateAuthority>CertificateAuthoritiesoptionalICertificateAuthority[]CertificateAuthoritiesoptional*[]ICertificateAuthority= none#
List of ACM Certificate Authorities to enable TLS authentication.
iamoptionalbooleaniamoptionalbooliamoptionalBooleanIamoptionalboolIamoptional*bool= false#
Enable IAM access control.
keyoptionalIKeyRefkeyoptionalIKeyRefkeyoptionalIKeyRefKeyoptionalIKeyRefKeyoptionalIKeyRef#
KMS Key to encrypt SASL/SCRAM secrets.

Default: CMK will be created with alias msk/{clusterName}/sasl/scram

You must use a customer master key (CMK) when creating users in secrets manager. You cannot use a Secret with Amazon MSK that uses the default Secrets Manager encryption key.

scramoptionalbooleanscramoptionalboolscramoptionalBooleanScramoptionalboolScramoptional*bool= false#
Enable SASL/SCRAM authentication.