aws / aws/aws-cdk

(aws-msk-alpha): Cannot provide my own encryption key for SASL Scram authentication

Open Beginner friendly
#22,617 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-msk bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

ClientAuthentication.sasl properties currently allow you to provide an encryption key for the user secret. However, the construct does not leverage that key.

Current code for authentication configuration:

```
clientAuthentication: ClientAuthentication.sasl({
scram: true,
key: props.kmsEncryptionKeyForCredentialsSecret,
})
```

Then, add user:
` this.cluster.addUser(user)`

### Expected Behavior

It will use the encryption key I provide.

### Current Behavior

It does not use the encryption key, nor creates new one.
It throws an error:` Cannot create users if an authentication KMS key has not been created/provided.`

### Reproduction Steps

See above.

### Possible Solution

Initialize `this.saslScramAuthenticationKey` with the provided key, if set.

https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-msk/lib/cluster.ts

### Additional Information/Context

_No response_

### CDK CLI Version

2.45

### Framework Version

_No response_

### Node.js Version

16.15.1

### OS

MacOS

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in packages/@aws-cdk/aws-msk/lib/cluster.ts and follow ClientAuthentication.sasl through the addUser entry point. Check how saslScramAuthenticationKey is initialized and confirm that a provided key is retained; done means addUser no longer reports that an authentication KMS key is missing when one was supplied.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kafka, typescript
Domain
authentication, cloud
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.