(aws-msk-alpha): Cannot provide my own encryption key for SASL Scram authentication
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
ClientAuthentication.sasl properties currently allow you to provide an encryption key for the user secret. However, the construct does not leverage that key.
Current code for authentication configuration:
```
clientAuthentication: ClientAuthentication.sasl({
scram: true,
key: props.kmsEncryptionKeyForCredentialsSecret,
})
```
Then, add user:
` this.cluster.addUser(user)`
### Expected Behavior
It will use the encryption key I provide.
### Current Behavior
It does not use the encryption key, nor creates new one.
It throws an error:` Cannot create users if an authentication KMS key has not been created/provided.`
### Reproduction Steps
See above.
### Possible Solution
Initialize `this.saslScramAuthenticationKey` with the provided key, if set.
https://github.com/aws/aws-cdk/blob/main/packages/%40aws-cdk/aws-msk/lib/cluster.ts
### Additional Information/Context
_No response_
### CDK CLI Version
2.45
### Framework Version
_No response_
### Node.js Version
16.15.1
### OS
MacOS
### Language
Typescript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start in packages/@aws-cdk/aws-msk/lib/cluster.ts and follow ClientAuthentication.sasl through the addUser entry point. Check how saslScramAuthenticationKey is initialized and confirm that a provided key is retained; done means addUser no longer reports that an authentication KMS key is missing when one was supplied.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kafka, typescript
- Domain
- authentication, cloud
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100