MSK Cluster connection failed with SASL authentication error for internal Kafka Users

Hi,

I have an MSK cluster with SASL/SCRAM enabled and created appropriate Super User for cluster with Secret to manage further users in cluster. If I create new users for example with Sarama client using this superuser as admin client, they appear in zookeeper config and kafka-configs, but connection for such users is failed with - Authentication failed during authentication due to invalid credentials with SASL mechanism SCRAM-SHA-512.

Can such internal Kafka users have access to MSK cluster with some additional configuration or every further user in MSK with SASL/SCRAM should have separate "Amazon_MSK_" prefixed secret and managed via KMS?

Ed Berezitsky
il y a 2 ans
Error points to failed authentication. I think the user hasn't been created properly, or a client application doesn't define properties correctly. Please add more details, make sure the secret you are using is listed under MSK -https://docs.aws.amazon.com/cli/latest/reference/kafka/list-scram-secrets.html . Follow the documentation to properly define a new user for MSK: https://docs.aws.amazon.com/msk/latest/developerguide/msk-password.html
FilatovM
il y a 2 ans
Let me clarify, I used only Kafka API and created user (No MSK secrets). In vanilla Kafka it works (all users are stored in ZK config), but in AWS such users fail authentication.

Can I use AWS admin user to create other users via default Kafka API? Or such users are not considered as valid credentials to connect MSK?

Sujets: Analyse Sécurité, identité et conformité
Balises: AWS Identity and Access Management Streaming géré par Amazon pour Apache Kafka (Amazon MSK)
Langue: English

FilatovM

demandé il y a 2 ans889 vues

1 réponse

Le plus récent
Le plus de votes
La plupart des commentaires

Ces réponses sont-elles utiles ? Votez pour la bonne réponse pour aider la communauté à bénéficier de vos connaissances.

MSK supports SASL SCRAM with the users defined in AWS Secrets Manager ONLY. Please follow the documentation on how to create and associate a user with MSK. After that, use Kafka ACLs to manage permissions for that users.

Ed Berezitsky

répondu il y a 2 ans

Contenus pertinents

Amazon Q developper Pro / Vscode
Ahmed BENHARRAT
demandé il y a un an
Plus d'accès à Amazon Q developper depuis Vscode
Averroes
demandé il y a un an
AWS Blu Age Go live-Test application-test online
User-0629970
demandé il y a 2 ans
AWS Blu Age Go live-Test application-test online
User-0629970
demandé il y a 2 ans
Comment résoudre les erreurs lorsque j'utilise l'authentification client IAM ou SASL/SCRAM pour me connecter à mon cluster Amazon MSK ?
AWS OFFICIELA mis à jour il y a 8 mois
Comment puis-je résoudre les problèmes liés aux déclencheurs Lambda qui interrogent Amazon MSK et des clusters Apache Kafka autogérés ?
AWS OFFICIELA mis à jour il y a 2 ans
Comment résoudre les problèmes d'authentification et d'autorisation lorsque j'utilise mon cluster Amazon MSK avec l'authentification SASL/SCRAM activée ?
AWS OFFICIELA mis à jour il y a un an
Comment résoudre les erreurs lorsque j'utilise l'authentification client TLS pour me connecter à mon cluster Amazon MSK ?
AWS OFFICIELA mis à jour il y a 6 mois

MSK Cluster connection failed with SASL authentication error for internal Kafka Users

Ajoutez votre réponse

Contenus pertinents