aws_msk_iam

Documentation

Index

• type Mechanism
  • func (m *Mechanism) Name() string
  • func (m *Mechanism) Next(ctx context.Context, challenge []byte) (bool, []byte, error)
  • func (m *Mechanism) Start(ctx context.Context) (sess sasl.StateMachine, ir []byte, err error)

Types

type Mechanism

type Mechanism struct {
	// The sigv4.Signer to use when signing the request. Required.
	Signer *sigv4.Signer
	// The region where the msk cluster is hosted, e.g. "us-east-1". Required.
	Region string
	// The time the request is planned for. Optional, defaults to time.Now() at time of authentication.
	SignTime time.Time
	// The duration for which the presigned request is active. Optional, defaults to 5 minutes.
	Expiry time.Duration
}

Mechanism implements sasl.Mechanism for the AWS_MSK_IAM mechanism, based on the official java implementation: https://github.com/aws/aws-msk-iam-auth

func (*Mechanism) Name

func (m *Mechanism) Name() string

func (*Mechanism) Next

func (m *Mechanism) Next(ctx context.Context, challenge []byte) (bool, []byte, error)

func (*Mechanism) Start

func (m *Mechanism) Start(ctx context.Context) (sess sasl.StateMachine, ir []byte, err error)

Start produces the authentication values required for AWS_MSK_IAM. It produces the following json as a byte array, making use of the aws-sdk to produce the signed output.

{
  "version" : "2020_10_22",
  "host" : "<broker host>",
  "user-agent": "<user agent string from the client>",
  "action": "kafka-cluster:Connect",
  "x-amz-algorithm" : "<algorithm>",
  "x-amz-credential" : "<clientAWSAccessKeyID>/<date in yyyyMMdd format>/<region>/kafka-cluster/aws4_request",
  "x-amz-date" : "<timestamp in yyyyMMdd'T'HHmmss'Z' format>",
  "x-amz-security-token" : "<clientAWSSessionToken if any>",
  "x-amz-signedheaders" : "host",
  "x-amz-expires" : "<expiration in seconds>",
  "x-amz-signature" : "<AWS SigV4 signature computed by the client>"
}