MSK Replicator now supports OAuth 2.0 for migrating Kafka clusters
Amazon MSK Replicator has added support for OAuth 2.0 (SASL/OAUTHBEARER) authentication, enabling the migration of external or self-managed Apache Kafka clusters that use OAuth to Amazon MSK. This enhancement ensures topics, configurations, and consumer-group offsets are synchronized during the cutover process. The feature is compatible with any OAuth 2.0 (OIDC) identity provider, including Keycloak, Okta, and Microsoft Entra ID. It supports three grant types, allowing flexibility based on existing client authentication methods.
- →MSK Replicator adds OAuth 2.0 authentication support
- →MSK Replicator supports three OAuth 2.0 grant types
- →Mechanism of OAuth 2.0 authentication with MSK Replicator
Features (2) ›
- MSK Replicator adds OAuth 2.0 authentication support
Amazon MSK Replicator now supports OAuth 2.0 (SASL/OAUTHBEARER) authentication for connecting to external Apache Kafka clusters. This enhancement allows users to migrate OAuth-authenticated Kafka clusters to Amazon MSK while preserving topic configurations and consumer group offsets.
- MSK Replicator supports three OAuth 2.0 grant types
MSK Replicator offers CLIENT_CREDENTIALS for client_id/client_secret, IAM_JWT_BEARER for secretless authentication via AWS STS JWT, and CLIENT_CREDENTIALS_ASSERTION for IdPs trusting signed-JWT clients. Users can choose the appropriate grant type based on how their existing Kafka clients authenticate to their IdP.
Notes (1) ›
- Mechanism of OAuth 2.0 authentication with MSK Replicator
The post details the SASL/OAUTHBEARER handshake, where MSK Replicator requests an access token from an Identity Provider (IdP) and presents it to Kafka brokers. Brokers locally verify the JWT signature using cached JWKS public keys, ensuring the IdP is not in the hot path for message traffic.
https://aws.amazon.com/blogs/big-data/migrate-an-oauth-2-0-authenticated-apache-kafka-cluster-to-amazon-msk-with-msk-replicator/
Related releases
- Amazon Connect Customer Adds Points-Based Scoring for Agent Evaluations AWS What's New ·
- HashiCorp Terraform AWS Provider v6.62.0 Adds New Resources and Enhancements Terraform AWS Provider Releases ·
- AWS Security shares July 2026 recap of new capabilities and guidance AWS Security Blog ·
- Amazon MSK Now Supports In-Place ZooKeeper-to-KRaft Cluster Upgrades AWS Big Data Blog ·
- AWS CLI integrates Agent Toolkit for AWS to enhance AI coding agents AWS Developer Tools Blog ·
- Detecting Multi-Stage Attacks on AWS: A Guide to Cross-Service Signal Correlation AWS Security Blog ·