How to enable cross account IAM authenticated access between MSK-Connector and provisioned MSK-Broker?

Question

We have MSK Connector under account A in VPC-A that needs to connect to provisioned MSK Broker under account B in VPC-B via IAM authenticated port 9098. VPC-A and VPC-B are peered.  What are all of the available options to enable this?

**Note**: There doesn't seem to be a way to allow MSK-Connect under account A to assume a role in account B - which is typically what we do for cross account access of resources.  If this is now possible, please provide details on how to enable this.

Yaniv Rozenboim · Accepted Answer

Have a look at a feature called [multi-VPC private connectivity](https://docs.aws.amazon.com/msk/latest/developerguide/aws-access-mult-vpc.html) which was introduced to solve exactly this challenge.

There is also a [blog post](https://aws.amazon.com/blogs/big-data/connect-kafka-client-applications-securely-to-your-amazon-msk-cluster-from-different-vpcs-and-aws-accounts/) that explains how to use it.

How to enable cross account IAM authenticated access between MSK-Connector and provisioned MSK-Broker?

Relevant content