AWS msk documentation change
Summary
Added new troubleshooting section 'Unable to access cluster through IPv6 bootstrap' with configuration guidance
Security assessment
The change adds documentation about IPv6 connectivity requirements and security group configurations, which are security-related network controls. However, there's no evidence of a specific security vulnerability being addressed.
Diff
diff --git a/msk/latest/developerguide/troubleshooting.md b/msk/latest/developerguide/troubleshooting.md index 110f91088..948ec1c10 100644 --- a//msk/latest/developerguide/troubleshooting.md +++ b//msk/latest/developerguide/troubleshooting.md @@ -5 +5 @@ -Volume replacement causes disk saturation due to replication overloadConsumer group stuck in PreparingRebalance stateError delivering broker logs to Amazon CloudWatch LogsNo default security groupCluster appears stuck in the CREATING stateCluster state goes from CREATING to FAILEDCluster state is ACTIVE but producers cannot send data or consumers cannot receive dataAWS CLI doesn't recognize Amazon MSKPartitions go offline or replicas are out of syncDisk space is running lowMemory running lowProducer gets NotLeaderForPartitionExceptionUnder-replicated partitions (URP) greater than zeroCluster has topics called __amazon_msk_canary and __amazon_msk_canary_statePartition replication failsUnable to access cluster that has public access turned onUnable to access cluster from within AWS: Networking issuesFailed authentication: Too many connectsFailed authentication: Session too shortMSK Serverless: Cluster creation failsCan’t update KafkaVersionsList in MSK configuration +Volume replacement causes disk saturation due to replication overloadConsumer group stuck in PreparingRebalance stateError delivering broker logs to Amazon CloudWatch LogsNo default security groupCluster appears stuck in the CREATING stateCluster state goes from CREATING to FAILEDCluster state is ACTIVE but producers cannot send data or consumers cannot receive dataAWS CLI doesn't recognize Amazon MSKPartitions go offline or replicas are out of syncDisk space is running lowMemory running lowProducer gets NotLeaderForPartitionExceptionUnder-replicated partitions (URP) greater than zeroCluster has topics called __amazon_msk_canary and __amazon_msk_canary_statePartition replication failsUnable to access cluster that has public access turned onUnable to access cluster through IPv6 bootstrapUnable to access cluster from within AWS: Networking issuesFailed authentication: Too many connectsFailed authentication: Session too shortMSK Serverless: Cluster creation failsCan’t update KafkaVersionsList in MSK configuration @@ -44,0 +45,2 @@ The following information can help you troubleshoot problems that you might have + * Unable to access cluster through IPv6 bootstrap + @@ -203,0 +206,13 @@ If your cluster has public access turned on, but you still cannot access it from +## Unable to access cluster through IPv6 bootstrap + +If you're having trouble connecting to a cluster using the provided IPv6 bootstrap strings, follow these steps: + + 1. Ensure your client has both IPv4 and IPv6 addresses assigned. Your client application must be running in a subnet that has both IPv4 and IPv6 addressing enabled and properly configured. Check if your VPC has both IPv4 CIDR block and an associated IPv6 CIDR block, confirm your subnet has both IPv4 and IPv6 addresses enabled, and verify your EC2 instance or client environment has both IPv4 and IPv6 addresses assigned. For more information, see [IP addressing for your VPCs and subnets](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-ip-addressing.html) in the Amazon VPC User Guide. + + 2. Ensure relevant IPv6 ports are present in the security group inbound and outbound rules. Add inbound rules to allow traffic on the cluster's ports from your IPv6 addresses and configure outbound rules to allow IPv6 traffic. For specific port numbers, see [Port information](https://docs.aws.amazon.com/msk/latest/developerguide/port-info.html) in the MSK documentation. Remember to update both IPv4 and IPv6 rules if running in dual-stack mode. For more information about security groups and their inbound and outbound rules, see [Security groups for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html) in the Amazon VPC User Guide. + + 3. Ensure JVM property configuration is correct for IPv6 support. In your client application, set `java.net.preferIPv6Addresses` to `true` and `java.net.preferIPv4Stack` to `false`. These settings can be configured either as system properties or JVM arguments. Restart your application after making these changes for them to take effect. + + + +