PUT ACL to MSK cluster

The error message you're encountering suggests that your IAM role or user doesn't have the necessary permissions to manage ACLs on your MSK cluster, even though you can create topics.

To resolve this issue, you need to ensure that your IAM policy includes the appropriate permissions for managing ACLs. Specifically, you should add the "kafka-cluster:AlterCluster" action to your IAM policy. This action allows you to modify cluster-wide settings, including ACLs.

Here's an example of what your IAM policy should include:

{
  "Effect": "Allow",
  "Action": [
    "kafka-cluster:Connect",
    "kafka-cluster:CreateTopic",
    "kafka-cluster:AlterTopic",
    "kafka-cluster:DeleteTopic",
    "kafka-cluster:AlterCluster",
    "kafka-cluster:Describe*"
  ],
  "Resource": [
    "arn:aws:kafka:region:account-id:cluster/cluster-name/*",
    "arn:aws:kafka:region:account-id:topic/cluster-name/*"
  ]
}

Make sure to replace "region", "account-id", and "cluster-name" with your specific values.

After updating your IAM policy, you should be able to manage ACLs on your MSK cluster using IAM authentication. Remember that changes to IAM policies may take a few minutes to propagate.

If you continue to face issues after updating the IAM policy, you may want to use AWS CloudTrail to identify which specific API calls are failing. This can help pinpoint any remaining permission issues.

Lastly, keep in mind that when using SASL/SCRAM authentication alongside IAM, you might need to configure additional ACLs directly on the Kafka cluster itself, depending on your specific use case and security requirements.
Sources
MSK Serverless - Not authorized to access group <groupName> error | AWS re:Post
Apache Kafka ACLs - Amazon Managed Streaming for Apache Kafka