JA EN
shiichan

Amazon MSK adds Authorizer Log Delivery: see exactly why Kafka clients get denied!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hi, it's Shii! Today I've got an update for anyone running Amazon MSK that makes tracking down access denials so much easier. Let's dive into how Kafka's authorization logging just got a lot more useful!

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, Amazon MSK (Managed Streaming for Apache Kafka) now supports Authorizer Log Delivery for Provisioned clusters. It works on both Standard and Express brokers, and there's no extra cost to turn it on.

Every denied authorization request gets logged with the client's IP address and the API it tried to call, so you can pinpoint exactly who got blocked and why.

The story so far

Until now, MSK didn't give you a detailed way to see user and application access activity, which made root-causing authorization errors a real chore. Without a clear trail of who was denied and for what operation, troubleshooting authorization settings or running a security audit took a lot more digging than it should have.

What changes

With Authorizer Log Delivery turned on, you get:

  • Detailed visibility into user and application access
  • A fast way to identify and fix client authorization problems
  • Easier compliance with audit and security requirements

Whether you're the engineer running the cluster or the person handling security reviews, figuring out "why can't this client connect?" should take a lot less digging now.

Dive Deep

You can send the logs to any of these three destinations:

  • Amazon CloudWatch Logs
  • Amazon S3
  • Amazon Data Firehose

You can turn it on from the Amazon MSK console or the AWS CLI, and it works for both new clusters and existing Provisioned clusters.

Authorizer Log Delivery is available in every AWS Region where Amazon MSK Provisioned clusters run, with one exception: the AWS European Sovereign Cloud (eusc-de-east-1) Region isn't supported yet.

Wrap-up

  • Amazon MSK Provisioned clusters now support Authorizer Log Delivery
  • Works on both Standard and Express brokers, at no additional cost
  • Denied requests are logged with the client's IP address and the API it attempted
  • Logs can go to CloudWatch Logs, S3, or Data Firehose
  • Available for both new and existing Provisioned clusters (except in eusc-de-east-1)

If you want tighter control over Kafka permissions or a faster way to troubleshoot MSK access issues, this update is worth turning on.

Related posts