Connect to Amazon MSK

What is MSK?

Amazon MSK is a self-managed service that makes it easy to build and run applications that use Apache Kafka to process streaming data.
It lacks several important Apache Kafka features like Kafka Connect, Kafka Streams, ksqlDB, and is not cloud-native (serverless, like S3 or Kinesis) but is just a provisioned infrastructure
AWS MSK supports also Kafka Connect clusters. Read more about it.

Conduktor & MSK

Conduktor, which is running on your computer, has no access by default to MSK. Still, it's possible to connect it to the cluster by using a specialized kafka proxy in-between.
To make it work:
1
$ sudo docker run --net host \
2
-e KAFKAPROXY_HOSTNAME=localhost\
3
-e KAFKAPROXY_BASE_PORT=4000 \
4
-e KAFKAPROXY_BOOTSTRAP_SERVERS=MYBROKER1:9092,broker2:9092,broker3:9092 \
5
dajudge/kafkaproxy:latest
6
Copied!
    On your local machine, do a ssh-tunnel to this EC2 instance:
1
$ ssh -i ~/.ssh/ec2-key.pem -N \
2
-L 4000:localhost:4000 \
3
-L 4001:localhost:4001 \
4
-L 4002:localhost:4002 \
5
<ec2instance>
Copied!
    Connect Conduktor using localhost:4000
The networking layer looks like this (not public):

Alternative: Another Proxy

If you get some errors such as "Exception in upstream channel.: java.lang.IllegalArgumentException: Invalid version for API key METADATA: 11", your proxy may be incompatible with your version of Apache Kafka.
You can try running another proxy: https://github.com/grepplabs/kafka-proxy It's a bit more complicated to setup but is more configurable.
    Run the proxy on an EC2 machine running in the MSK network:
      Map all your brokers
1
docker run --rm --net host grepplabs/kafka-proxy:latest \
2
          server \
3
        --bootstrap-server-mapping "b-1.mymsk.xxx.kafka.us-west-2.amazonaws.com:9092,0.0.0.0:32500,127.0.0.1:32500" \
4
        --bootstrap-server-mapping "b-2.mymsk.xxx.kafka.us-west-2.amazonaws.com:9092,0.0.0.0:32501,127.0.0.1:32501" \
5
        --bootstrap-server-mapping "b-3.mymsk.xxx.kafka.us-west-2.amazonaws.com:9092,0.0.0.0:32502,127.0.0.1:32502" \
6
        --bootstrap-server-mapping "b-4.mymsk.xxx.kafka.us-west-2.amazonaws.com:9092,0.0.0.0:32503,127.0.0.1:32503" \
7
        --dynamic-listeners-disable \
8
        --debug-enable
9
Copied!
    SSH forward locally to your EC2 machine:
      Forward all the ports
1
ssh -i ~/.ssh/ec2-key.pem -N \
2
     -L 32500:localhost:32500 \
3
     -L 32501:localhost:32501 \
4
     -L 32502:localhost:32502 \
5
     -L 32503:localhost:32503 \
Copied!
    Connect your Conduktor to localhost:32500

Connect using AWS IAM

Conduktor fully handles AWS IAM, you just have to setup your connection with your IAM access.

AWS MSK + IAM Architecture

A small overview of "what's going on" when you use AWS MSK and configure IAM (read the mentioned blog above for more details):

Configuration Example

Here is an example of configuration you can copy/paste. Just update the awsProfileName to yours:
1
security.protocol=SASL_SSL
2
sasl.mechanism=AWS_MSK_IAM
3
sasl.jaas.config = software.amazon.msk.auth.iam.IAMLoginModule required awsProfileName="stephane-msk";
4
sasl.client.callback.handler.class=software.amazon.msk.auth.iam.IAMClientCallbackHandler
Copied!

IAM Example

A basic (broad) example of configuring IAM policy to access everything on MSK:
1
{
2
"Version": "2012-10-17",
3
"Statement": [
4
{
5
"Effect": "Allow",
6
"Action": "kafka-cluster:*",
7
"Resource": [
8
"arn:aws:kafka:us-east-1:111222333444:cluster/*/*",
9
"arn:aws:kafka:us-east-1:111222333444:group/*/*/*",
10
"arn:aws:kafka:us-east-1:111222333444:transactional-id/*/*/*",
11
"arn:aws:kafka:us-east-1:111222333444:topic/*/*/*"
12
]
13
},
14
...
15
}
Copied!
Last modified 11d ago