AWS msk documentation change
Summary
Added comprehensive documentation for MSK replicator API including log delivery configurations (S3, Firehose, CloudWatch Logs), enhanced consumer offset synchronization modes, Apache Kafka cluster support with client authentication (SASL/SCRAM), encryption in transit, and cluster ID parameters
Security assessment
This change adds documentation for security features including client authentication via SASL/SCRAM with Secrets Manager integration, encryption in transit with TLS and root CA certificates, but does not indicate any specific security vulnerability being addressed. The documentation appears to be adding new API capabilities rather than fixing security issues.
Diff
diff --git a/msk/1.0/apireference-replicator/v1-replicators.md b/msk/1.0/apireference-replicator/v1-replicators.md index 801c17e3c..5237e08b5 100644 --- a//msk/1.0/apireference-replicator/v1-replicators.md +++ b//msk/1.0/apireference-replicator/v1-replicators.md @@ -45,0 +46,2 @@ Creates the replicator. +Note: Enhanced consumer offset syncing is only supported when the `topicNameConfiguration` type is `IDENTICAL`. + @@ -72,0 +75,17 @@ ResponsesStatus code| Response model| Description + "logDelivery": { + "replicatorLogDelivery": { + "s3": { + "bucket": "string", + "prefix": "string", + "enabled": boolean + }, + "firehose": { + "deliveryStream": "string", + "enabled": boolean + }, + "cloudWatchLogs": { + "logGroup": "string", + "enabled": boolean + } + } + }, @@ -79,0 +99 @@ ResponsesStatus code| Response model| Description + "consumerGroupOffsetSyncMode": enum, @@ -105 +125,3 @@ ResponsesStatus code| Response model| Description - "targetKafkaClusterArn": "string" + "targetKafkaClusterArn": "string", + "sourceKafkaClusterId": "string", + "targetKafkaClusterId": "string" @@ -120,0 +143,14 @@ ResponsesStatus code| Response model| Description + }, + "encryptionInTransit": { + "encryptionType": enum, + "rootCaCertificate": "string" + }, + "apacheKafkaCluster": { + "bootstrapBrokerString": "string", + "apacheKafkaClusterId": "string" + }, + "clientAuthentication": { + "saslScram": { + "secretArn": "string", + "mechanism": enum + } @@ -142,0 +179,4 @@ ResponsesStatus code| Response model| Description + }, + "apacheKafkaCluster": { + "bootstrapBrokerString": "string", + "apacheKafkaClusterId": "string" @@ -176,0 +217,29 @@ Property| Type| Required| Description +### ApacheKafkaCluster + +Details of an Apache Kafka cluster. + +Property| Type| Required| Description +---|---|---|--- +`apacheKafkaClusterId`| string| True| The globally unique cluster ID of the Apache Kafka cluster. For information on how to retrieve the cluster ID, see https://github.com/apache/kafka/blob/trunk/bin/kafka-cluster.sh +`bootstrapBrokerString`| string| True| The bootstrap broker string of the Apache Kafka cluster. + +### CloudWatchLogs + +CloudWatch Logs details for ReplicatorLogDelivery. + +Property| Type| Required| Description +---|---|---|--- +`enabled`| boolean| True| Whether log delivery to CloudWatch Logs is enabled. +`logGroup`| string| False| The CloudWatch log group that is the destination for log delivery. + +### ConsumerGroupOffsetSyncMode + +The consumer group offset synchronization mode. With LEGACY, offsets are synchronized when producers write to the source cluster. With ENHANCED, consumer offsets are synchronized regardless of producer location. ENHANCED requires a corresponding replicator that replicates data from the target cluster to the source cluster. + + * `LEGACY` + + * `ENHANCED` + + + + @@ -182,0 +252 @@ Property| Type| Required| Description +`consumerGroupOffsetSyncMode`| ConsumerGroupOffsetSyncMode| False| The consumer group offset synchronization mode. With LEGACY, offsets are synchronized when producers write to the source cluster. With ENHANCED, consumer offsets are synchronized regardless of producer location. ENHANCED requires a corresponding replicator that replicates data from the target cluster to the source cluster. @@ -195,0 +266 @@ Property| Type| Required| Description +`logDelivery`| LogDelivery| False| Configuration for delivering replicator logs to customer destinations. @@ -210,0 +282,9 @@ Property| Type| Required| Description +### Firehose + +Firehose details for ReplicatorLogDelivery. + +Property| Type| Required| Description +---|---|---|--- +`deliveryStream`| string| False| The Firehose delivery stream that is the destination for log delivery. +`enabled`| boolean| True| Whether log delivery to Firehose is enabled. + @@ -217,2 +297,13 @@ Property| Type| Required| Description -`amazonMskCluster`| AmazonMskCluster| True| Details of an Amazon MSK Cluster. -`vpcConfig`| KafkaClusterClientVpcConfig| True| Details of an Amazon VPC which has network connectivity to the Apache Kafka cluster. +`amazonMskCluster`| AmazonMskCluster| False| Details of an Amazon MSK Cluster. +`apacheKafkaCluster`| ApacheKafkaCluster| False| Details of an Apache Kafka cluster. Exactly one of amazonMskCluster and apacheKafkaCluster is required. +`clientAuthentication`| KafkaClusterClientAuthentication| False| Details of the client authentication used by the Apache Kafka cluster. +`encryptionInTransit`| KafkaClusterEncryptionInTransit| False| Details of encryption in transit to the Apache Kafka cluster. +`vpcConfig`| KafkaClusterClientVpcConfig| False| Details of an Amazon VPC which has network connectivity to the Apache Kafka cluster. + +### KafkaClusterClientAuthentication + +Details of the client authentication used by the Apache Kafka cluster. + +Property| Type| Required| Description +---|---|---|--- +`saslScram`| KafkaClusterSaslScramAuthentication| True| Details for SASL/SCRAM client authentication. @@ -228,0 +320,38 @@ Property| Type| Required| Description +### KafkaClusterEncryptionInTransit + +Details of encryption in transit to the Apache Kafka cluster. + +Property| Type| Required| Description +---|---|---|--- +`encryptionType`| KafkaClusterEncryptionInTransitType| True| The type of encryption in transit to the Apache Kafka cluster. +`rootCaCertificate`| string| False| Amazon Resource Name (ARN) of the Secrets Manager secret containing the root CA certificate for TLS encryption. + +### KafkaClusterEncryptionInTransitType + +The type of encryption in transit to the Apache Kafka cluster. + + * `TLS` + + + + +### KafkaClusterSaslScramAuthentication + +Details for SASL/SCRAM client authentication. + +Property| Type| Required| Description +---|---|---|--- +`mechanism`| KafkaClusterSaslScramMechanism| True| The SCRAM mechanism to use for authentication. +`secretArn`| string| True| Amazon Resource Name (ARN) of the Secrets Manager secret containing the username and password. + +### KafkaClusterSaslScramMechanism + +The SCRAM mechanism to use for authentication. + + * `SHA256` + + * `SHA512` + + + + @@ -235,0 +365 @@ Property| Type| Required| Description +`apacheKafkaCluster`| ApacheKafkaCluster| False| Details of an Apache Kafka Cluster. @@ -246,0 +377,8 @@ Property| Type| Required| Description +### LogDelivery + +Configuration for log delivery to customer destinations. + +Property| Type| Required| Description +---|---|---|--- +`replicatorLogDelivery`| ReplicatorLogDelivery| False| Configuration for replicator log delivery. + @@ -254 +392,2 @@ Property| Type| Required| Description -`sourceKafkaClusterArn`| string| True| The ARN of the source Kafka cluster. +`sourceKafkaClusterArn`| string| False| The ARN of the source Kafka cluster. +`sourceKafkaClusterId`| string| False| The cluster ID of the source Apache Kafka cluster. Specify either sourceKafkaClusterArn or sourceKafkaClusterId, but not both. @@ -256 +395,2 @@ Property| Type| Required| Description -`targetKafkaClusterArn`| string| True| The ARN of the target Kafka cluster. +`targetKafkaClusterArn`| string| False| The ARN of the target Kafka cluster. +`targetKafkaClusterId`| string| False| The cluster ID of the target Apache Kafka cluster. Specify either targetKafkaClusterArn or targetKafkaClusterId, but not both. @@ -305,0 +446,10 @@ The type of replication topic name configuration, identical to upstream topic na +### ReplicatorLogDelivery + +Configuration for replicator log delivery. + +Property| Type| Required| Description +---|---|---|--- +`cloudWatchLogs`| CloudWatchLogs| False| Configuration for CloudWatch Logs delivery. +`firehose`| Firehose| False| Configuration for Firehose delivery. +`s3`| S3| False| Configuration for S3 delivery. + @@ -338,0 +489,10 @@ Property| Type| Required| Description +### S3 + +S3 details for ReplicatorLogDelivery. + +Property| Type| Required| Description +---|---|---|--- +`bucket`| string| False| The S3 bucket that is the destination for log delivery. +`enabled`| boolean| True| Whether log delivery to S3 is enabled. +`prefix`| string| False| The S3 prefix that is the destination for log delivery. +