Package: aws-cdk.aws-msk
Amazon Managed Streaming for Apache Kafka Construct Library---AWS CDK v1 has reached End-of-Support on 2023-06-01.
This package is no longer being updated, and users should migrate to AWS CDK v2.For more information on how to migrate, see theMigrating to AWS CDK v2guide.Amazon MSKis a fully managed service that makes it easy for you to build and run applications that use Apache Kafka to process streaming data.The following example creates an MSK Cluster.# vpc: ec2.Vpccluster=msk.Cluster(self,"Cluster",cluster_name="myCluster",kafka_version=msk.KafkaVersion.V2_8_1,vpc=vpc)Allowing ConnectionsTo control who can access the Cluster, use the.connectionsattribute. For a list of ports used by MSK, refer to theMSK documentation.# vpc: ec2.Vpccluster=msk.Cluster(self,"Cluster",cluster_name="myCluster",kafka_version=msk.KafkaVersion.V2_8_1,vpc=vpc)cluster.connections.allow_from(ec2.Peer.ipv4("1.2.3.4/8"),ec2.Port.tcp(2181))cluster.connections.allow_from(ec2.Peer.ipv4("1.2.3.4/8"),ec2.Port.tcp(9094))Cluster EndpointsYou can use the following attributes to get a list of the Kafka broker or ZooKeeper node endpoints# cluster: msk.ClusterCfnOutput(self,"BootstrapBrokers",value=cluster.bootstrap_brokers)CfnOutput(self,"BootstrapBrokersTls",value=cluster.bootstrap_brokers_tls)CfnOutput(self,"BootstrapBrokersSaslScram",value=cluster.bootstrap_brokers_sasl_scram)CfnOutput(self,"ZookeeperConnection",value=cluster.zookeeper_connection_string)CfnOutput(self,"ZookeeperConnectionTls",value=cluster.zookeeper_connection_string_tls)Importing an existing ClusterTo import an existing MSK cluster into your CDK app use the.fromClusterArn()method.cluster=msk.Cluster.from_cluster_arn(self,"Cluster","arn:aws:kafka:us-west-2:1234567890:cluster/a-cluster/11111111-1111-1111-1111-111111111111-1")Client AuthenticationMSK supportsthe following authentication mechanisms.Only one authentication method can be enabled.TLSTo enable client authentication with TLS set thecertificateAuthorityArnsproperty to reference your ACM Private CA.More info on Private CAs.importaws_cdk.aws_acmpcaasacmpca# vpc: ec2.Vpccluster=msk.Cluster(self,"Cluster",cluster_name="myCluster",kafka_version=msk.KafkaVersion.V2_8_1,vpc=vpc,encryption_in_transit=msk.EncryptionInTransitConfig(client_broker=msk.ClientBrokerEncryption.TLS),client_authentication=msk.ClientAuthentication.tls(certificate_authorities=[acmpca.CertificateAuthority.from_certificate_authority_arn(self,"CertificateAuthority","arn:aws:acm-pca:us-west-2:1234567890:certificate-authority/11111111-1111-1111-1111-111111111111")]))SASL/SCRAMEnable client authentication withSASL/SCRAM:# vpc: ec2.Vpccluster=msk.Cluster(self,"cluster",cluster_name="myCluster",kafka_version=msk.KafkaVersion.V2_8_1,vpc=vpc,encryption_in_transit=msk.EncryptionInTransitConfig(client_broker=msk.ClientBrokerEncryption.TLS),client_authentication=msk.ClientAuthentication.sasl(scram=True))SASL/IAMEnable client authentication withIAM:# vpc: ec2.Vpccluster=msk.Cluster(self,"cluster",cluster_name="myCluster",kafka_version=msk.KafkaVersion.V2_8_1,vpc=vpc,encryption_in_transit=msk.EncryptionInTransitConfig(client_broker=msk.ClientBrokerEncryption.TLS),client_authentication=msk.ClientAuthentication.sasl(iam=True))