aws / aws/aws-cdk

(msk): Expose Secret when creating new SASL/SCRAM User in MSK

Open
#16,975 1 comment 5 reactions 0 assignees View on GitHub
@aws-cdk/aws-msk effort/small feature-request p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Description

The add_user() method allows to add a SASL/SCRAM user to an MSK cluster. This generates a secret in Secretsmanager and associates it with the MSK cluster.

For applications to use it they need permissions on the Encryptionkey and the Secret itself. The Key is exposed via `msk-cluster.sasl_scram_authentication_key` but the secretArn is not.

### Use Case

Granting producer / consumers access the use the generated secret.

### Proposed Solution

Would expect something like this:
```python

msk_user_secret = msk_cluster.sasl_scram_authentication_secret(
user='msk-user'
)

msk_user_secret.grant_read(producer.role)
```

The method would need to take a user parameter unlike `authentication_key` as the secret is different for each created user.

### Other information

Workaround:
Import the secret via Secret name and grant access:

```python
msk_user_secret = secretsmanager.Secret.from_secret_name(
self, 'mskUserSecret',
secret_name=f'AmazonMSK_{cluster_name}_{msk_user}'
)

msk_user_secret.grant_read(producer.role)
```

### Acknowledge

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

Contributor guide

Open the contributing guide

Research direction

Start by locating the MSK implementation of add_user() and the sasl_scram_authentication_key property, then inspect any related tests. The change is done when a per-user secret can be exposed and its grant_read method can be used for the generated MSK credential.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.