(msk): Expose Secret when creating new SASL/SCRAM User in MSK
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Description
The add_user() method allows to add a SASL/SCRAM user to an MSK cluster. This generates a secret in Secretsmanager and associates it with the MSK cluster.
For applications to use it they need permissions on the Encryptionkey and the Secret itself. The Key is exposed via `msk-cluster.sasl_scram_authentication_key` but the secretArn is not.
### Use Case
Granting producer / consumers access the use the generated secret.
### Proposed Solution
Would expect something like this:
```python
msk_user_secret = msk_cluster.sasl_scram_authentication_secret(
user='msk-user'
)
msk_user_secret.grant_read(producer.role)
```
The method would need to take a user parameter unlike `authentication_key` as the secret is different for each created user.
### Other information
Workaround:
Import the secret via Secret name and grant access:
```python
msk_user_secret = secretsmanager.Secret.from_secret_name(
self, 'mskUserSecret',
secret_name=f'AmazonMSK_{cluster_name}_{msk_user}'
)
msk_user_secret.grant_read(producer.role)
```
### Acknowledge
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
Contributor guide
Research direction
Start by locating the MSK implementation of add_user() and the sasl_scram_authentication_key property, then inspect any related tests. The change is done when a per-user secret can be exposed and its grant_read method can be used for the generated MSK credential.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100