feat: support AWS MSK IAM authentication (AWS_MSK_IAM SASL mechanism) - #345
Open
adiig7 wants to merge 2 commits into
Open
feat: support AWS MSK IAM authentication (AWS_MSK_IAM SASL mechanism)#345adiig7 wants to merge 2 commits into
adiig7 wants to merge 2 commits into
Conversation
adiig7
force-pushed
the
feat/aws-msk-iam
branch
2 times, most recently
from
July 29, 2026 12:36
5d06985 to
d1b0884
Compare
Adds the AWS_MSK_IAM SASL mechanism using franz-go's built-in pkg/sasl/aws implementation. Credentials are resolved through the AWS SDK default credential chain (environment, shared config, EC2/ECS task role), with optional STS assume-role (roleArn/externalId/ roleSessionName) and an optional region override for credential resolution. Supersedes redpanda-data#305, addressing the review feedback (struct renamed to AWSConfig for consistency with the other SASL mechanism configs).
Avoids the newest transitive modules (service/signin, internal/v4a) flagged by the Snyk license/security checks; matches the dependency footprint of redpanda-data#305.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
AWS_MSK_IAMas a supported SASL mechanism so KMinion can connect to IAM-auth-only Amazon MSK clusters.pkg/sasl/aws(ManagedStreamingIAM) — no new SASL implementation, just wiring it into the existing mechanism switchroleArn/externalId/roleSessionNameunderkafka.sasl.awsdocs/reference-config.yamland README mechanism list updatedWhy
Amazon MSK clusters configured with IAM access control only accept the custom
AWS_MSK_IAMSASL mechanism (port 9098). KMinion currently supports PLAIN/SCRAM/GSSAPI/OAUTHBEARER, so it cannot connect to such clusters at all — and IAM-only is a common posture since it needs no secret management on the Kafka side.Relationship to #305
This supersedes #305 by @AdrienneCohea (credit to her for the original implementation — the wiring here follows the same approach). That PR's only review feedback from @sbocinec was to rename the config struct for consistency with the other SASL mechanism configs; this PR names it
AWSConfigaccordingly. Also avoids the franz-go version bump from #305 since current master (v1.20.6) already includespkg/sasl/aws.Testing
go build ./...,go vet ./...,go test ./...pass; gofmt clean on touched filesAWS_MSK_IAMaccepted, unknown mechanisms still rejected)