MSK Replicator adds mTLS for external Kafka to MSK Express
Amazon MSK Replicator now supports mutual TLS (mTLS) authentication, allowing replication from external Kafka clusters to MSK Express brokers. This enhances hybrid and multi-cloud data migration, disaster recovery, and distribution scenarios. Previously limited to SASL/SCRAM, this feature expands connectivity options for migrating workloads and ensures data integrity during replication. It is available in all AWS Regions where MSK Express brokers are offered.
- →MSK Replicator supports mTLS for external Kafka replication
- →Expanded authentication options for MSK Replicator
- →Benefits of using MSK Replicator
- →Availability of mTLS support
Features (1) ›
- MSK Replicator supports mTLS for external Kafka replication
Amazon MSK Replicator now supports mutual TLS (mTLS) authentication for replicating data from external Apache Kafka clusters to Amazon MSK Express brokers. This feature enables migrating workloads, supporting disaster recovery, and facilitating data distribution across hybrid and multi-cloud environments.
Enhancements (1) ›
- Expanded authentication options for MSK Replicator
Previously limited to SASL/SCRAM, MSK Replicator now also supports mTLS authentication for connections to external Apache Kafka clusters. This provides greater flexibility for users connecting to MSK Express brokers.
Notes (2) ›
- Benefits of using MSK Replicator
MSK Replicator automates Kafka cluster data replication, retaining original topic names and avoiding replication loops. It also synchronizes consumer group offsets bidirectionally, allowing independent movement of producers and consumers across clusters without data loss.
- Availability of mTLS support
The new mTLS authentication capability for MSK Replicator is available in all AWS Regions where MSK Express brokers are available.
https://aws.amazon.com/about-aws/whats-new/2026/06/amazon-msk-replicator-mtls-support