Configure SSL in MSK Connect

Question

I need to configure msk connect so that it can receive data from a local kafka cluster using ssl, I have the truststore.jks and keystore.jks files but I can't find how I can configure the connector to be able to use them

My configuration is using a custom S3SinkConnector connector

connector_config = {
“connector.class” = “io.confluent.connect.s3.S3SinkConnector”
“tasks.max” = 2
“topics” = var.topic_name
“s3.region” = var.region
“s3.bucket.name” = aws_s3_bucket.msk_connect_sink.id
“flush.size” = 1
“storage.class” = “io.confluent.connect.s3.storage.S3Storage”
“format.class” = “io.confluent.connect.s3.format.json.JsonFormat”
“partitioner.class” = “io.confluent.connect.storage.partitioner.DefaultPartitioner”
“key.converter” = “org.apache.kafka.connect.storage.StringConverter”
“value.converter” = “org.apache.kafka.connect.storage.StringConverter”
“schema.compatibility” = “NONE”
}

How can I use SSL to authenticate?

Kidd Ip · Answer

To configure SSL for MSK Connect and enable it to receive data from a local Kafka cluster, you can use the truststore.jks and keystore.jks files in your connector configuration. Here's how you can set it up:

**Steps to Configure SSL in MSK Connect**

1. Update the Connector Configuration: Add the following SSL-related properties to your connector_config:

```
{
    "security.protocol": "SSL",
    "ssl.truststore.location": "/path/to/truststore.jks",
    "ssl.truststore.password": "your-truststore-password",
    "ssl.keystore.location": "/path/to/keystore.jks",
    "ssl.keystore.password": "your-keystore-password",
    "ssl.key.password": "your-key-password"
}
```

Replace /path/to/ with the actual file paths where your truststore.jks and keystore.jks files are stored. Ensure these files are accessible to the MSK Connect worker nodes.

2. Store the Files Securely:
* Upload the truststore.jks and keystore.jks files to a secure location, such as an Amazon S3 bucket.
* Use IAM roles and policies to restrict access to these files.

3. Reference Files in MSK Connect: If the files are stored in S3, you can use the s3import configuration provider to reference them:

```
{
    "ssl.truststore.location": "${s3import:region:bucket-name/truststore.jks}",
    "ssl.keystore.location": "${s3import:region:bucket-name/keystore.jks}"
}
```

4. Set Up Permissions: Ensure that the MSK Connect worker nodes have the necessary permissions to access the S3 bucket or the file paths where the .jks files are stored.

5. Restart the Connector: After updating the configuration, restart the connector to apply the changes.

Configure SSL in MSK Connect

Relevant content