AWS msk documentation change

Service: msk · 2026-04-22 · Documentation low

File: msk/1.0/apireference-replicator/v1-replicators-replicatorarn.md

Summary

Added comprehensive documentation for MSK Replicator API including encryption in transit, client authentication, log delivery, and consumer group offset synchronization modes

Security assessment

This change adds extensive documentation for security-related features including TLS encryption with root CA certificates, SASL/SCRAM authentication with Secrets Manager integration, and encryption type definitions. While these are security features, there is no evidence in the diff that this addresses a specific security vulnerability or incident - it appears to be routine API documentation expansion for existing security capabilities.

Diff

diff --git a/msk/1.0/apireference-replicator/v1-replicators-replicatorarn.md b/msk/1.0/apireference-replicator/v1-replicators-replicatorarn.md
index 1c3195ed9..1165cadba 100644
--- a//msk/1.0/apireference-replicator/v1-replicators-replicatorarn.md
+++ b//msk/1.0/apireference-replicator/v1-replicators-replicatorarn.md
@@ -95,0 +96,14 @@ ResponsesStatus code| Response model| Description
+          },
+          "encryptionInTransit": {
+            "encryptionType": enum,
+            "rootCaCertificate": "string"
+          },
+          "apacheKafkaCluster": {
+            "bootstrapBrokerString": "string",
+            "apacheKafkaClusterId": "string"
+          },
+          "clientAuthentication": {
+            "saslScram": {
+              "secretArn": "string",
+              "mechanism": enum
+            }
@@ -103,0 +118,17 @@ ResponsesStatus code| Response model| Description
+      "logDelivery": {
+        "replicatorLogDelivery": {
+          "s3": {
+            "bucket": "string",
+            "prefix": "string",
+            "enabled": boolean
+          },
+          "firehose": {
+            "deliveryStream": "string",
+            "enabled": boolean
+          },
+          "cloudWatchLogs": {
+            "logGroup": "string",
+            "enabled": boolean
+          }
+        }
+      },
@@ -110,0 +142 @@ ResponsesStatus code| Response model| Description
+            "consumerGroupOffsetSyncMode": enum,
@@ -163,0 +196,29 @@ Property| Type| Required| Description
+### ApacheKafkaCluster
+
+Details of an Apache Kafka cluster.
+
+Property| Type| Required| Description  
+---|---|---|---  
+`apacheKafkaClusterId`| string| True| The globally unique cluster ID of the Apache Kafka cluster. For information on how to retrieve the cluster ID, see https://github.com/apache/kafka/blob/trunk/bin/kafka-cluster.sh  
+`bootstrapBrokerString`| string| True| The bootstrap broker string of the Apache Kafka cluster.  
+  
+### CloudWatchLogs
+
+CloudWatch Logs details for ReplicatorLogDelivery.
+
+Property| Type| Required| Description  
+---|---|---|---  
+`enabled`| boolean| True| Whether log delivery to CloudWatch Logs is enabled.  
+`logGroup`| string| False| The CloudWatch log group that is the destination for log delivery.  
+  
+### ConsumerGroupOffsetSyncMode
+
+The consumer group offset synchronization mode. With LEGACY, offsets are synchronized when producers write to the source cluster. With ENHANCED, consumer offsets are synchronized regardless of producer location. ENHANCED requires a corresponding replicator that replicates data from the target cluster to the source cluster.
+
+  * `LEGACY`
+
+  * `ENHANCED`
+
+
+
+
@@ -169,0 +231 @@ Property| Type| Required| Description
+`consumerGroupOffsetSyncMode`| ConsumerGroupOffsetSyncMode| False| The consumer group offset synchronization mode. With LEGACY, offsets are synchronized when producers write to the source cluster. With ENHANCED, consumer offsets are synchronized regardless of producer location. ENHANCED requires a corresponding replicator that replicates data from the target cluster to the source cluster.  
@@ -193,0 +256 @@ Property| Type| Required| Description
+`logDelivery`| LogDelivery| False| Configuration for log delivery.  
@@ -203,0 +267,17 @@ Property| Type| Required| Description
+### Firehose
+
+Firehose details for ReplicatorLogDelivery.
+
+Property| Type| Required| Description  
+---|---|---|---  
+`deliveryStream`| string| False| The Firehose delivery stream that is the destination for log delivery.  
+`enabled`| boolean| True| Whether log delivery to Firehose is enabled.  
+  
+### KafkaClusterClientAuthentication
+
+Details of the client authentication used by the Apache Kafka cluster.
+
+Property| Type| Required| Description  
+---|---|---|---  
+`saslScram`| KafkaClusterSaslScramAuthentication| True| Details for SASL/SCRAM client authentication.  
+  
@@ -219,0 +300,3 @@ Property| Type| Required| Description
+`apacheKafkaCluster`| ApacheKafkaCluster| False| Details of an Apache Kafka Cluster.  
+`clientAuthentication`| KafkaClusterClientAuthentication| False| Details of the client authentication used by the Apache Kafka cluster.  
+`encryptionInTransit`| KafkaClusterEncryptionInTransit| False| Details of encryption in transit to the Apache Kafka cluster.  
@@ -222,0 +306,46 @@ Property| Type| Required| Description
+### KafkaClusterEncryptionInTransit
+
+Details of encryption in transit to the Apache Kafka cluster.
+
+Property| Type| Required| Description  
+---|---|---|---  
+`encryptionType`| KafkaClusterEncryptionInTransitType| True| The type of encryption in transit to the Apache Kafka cluster.  
+`rootCaCertificate`| string| False| Amazon Resource Name (ARN) of the Secrets Manager secret containing the root CA certificate for TLS encryption.  
+  
+### KafkaClusterEncryptionInTransitType
+
+The type of encryption in transit to the Apache Kafka cluster.
+
+  * `TLS`
+
+
+
+
+### KafkaClusterSaslScramAuthentication
+
+Details for SASL/SCRAM client authentication.
+
+Property| Type| Required| Description  
+---|---|---|---  
+`mechanism`| KafkaClusterSaslScramMechanism| True| The SCRAM mechanism to use for authentication.  
+`secretArn`| string| True| Amazon Resource Name (ARN) of the Secrets Manager secret containing the username and password.  
+  
+### KafkaClusterSaslScramMechanism
+
+The SCRAM mechanism to use for authentication.
+
+  * `SHA256`
+
+  * `SHA512`
+
+
+
+
+### LogDelivery
+
+Configuration for log delivery to customer destinations.
+
+Property| Type| Required| Description  
+---|---|---|---  
+`replicatorLogDelivery`| ReplicatorLogDelivery| False| Configuration for replicator log delivery.  
+  
@@ -281,0 +411,10 @@ The type of replication topic name configuration, identical to upstream topic na
+### ReplicatorLogDelivery
+
+Configuration for replicator log delivery.
+
+Property| Type| Required| Description  
+---|---|---|---  
+`cloudWatchLogs`| CloudWatchLogs| False| Configuration for CloudWatch Logs delivery.  
+`firehose`| Firehose| False| Configuration for Firehose delivery.  
+`s3`| S3| False| Configuration for S3 delivery.  
+  
@@ -298,0 +438,10 @@ State of a replicator.
+### S3
+
+S3 details for ReplicatorLogDelivery.
+
+Property| Type| Required| Description  
+---|---|---|---  
+`bucket`| string| False| The S3 bucket that is the destination for log delivery.  
+`enabled`| boolean| True| Whether log delivery to S3 is enabled.  
+`prefix`| string| False| The S3 prefix that is the destination for log delivery.  
+