support AWS IAM authentication for Amazon MSK

Is your feature request related to a problem?

TiCDC currently supports common Kafka authentication mechanisms such as SASL/SCRAM and SASL/OAUTHBEARER with a standard OAuth 2.0 token endpoint.

However, Amazon MSK Serverless requires AWS IAM authentication and does not support SASL/SCRAM. Amazon MSK Provisioned clusters configured with IAM access control have the same client-side requirement.

For non-Java Kafka clients, AWS IAM authentication is exposed through the Kafka SASL_OAUTHBEARER mechanism. The token is not obtained from a standard OAuth token endpoint. Instead, the client must generate a short-lived AWS SigV4 token using AWS credentials.

As a result, TiCDC cannot currently connect directly to:

• Amazon MSK Serverless
• Amazon MSK Provisioned clusters using IAM access control

The existing OAuth configuration based on client-id, client-secret, and token-url cannot be used for AWS MSK IAM authentication.

Describe the feature you'd like

Add an AWS MSK IAM token provider to the TiCDC Kafka sink.

The implementation should continue using Sarama's SASL_OAUTHBEARER mechanism, but allow TiCDC to generate the access token through the AWS MSK IAM signer.

Proposed configuration

One possible configuration format is:

[sink.kafka-config]
sasl-mechanism = "OAUTHBEARER"
sasl-oauth-provider = "aws-msk-iam"

aws-region = "ap-northeast-1"
aws-role-arn = "arn:aws:iam::123456789012:role/TiCDCMSKProducer"
aws-role-session-name = "ticdc"
aws-external-id = "example-external-id"

enable-tls = true
auto-create-topic = false

The exact configuration names are open for discussion.

The following credential modes should be considered:

1. AWS SDK default credential provider chain

• Environment variables
• EC2 instance role
• ECS task role
• EKS IRSA or Pod Identity
• Web identity credentials
• Shared AWS configuration

2. STS AssumeRole

• Role ARN
• Role session name
• Optional external ID

Static access keys should not be required and should preferably not be exposed through the changefeed sink URI.

Describe alternatives you've considered

No response

Teachability, Documentation, Adoption, Migration Strategy

No response