JA EN
shiichan

MSK Replicator Now Speaks OAuth 2.0 — Migrating from External Kafka Just Got Easier

AWS What's New ★★★★ View Markdown
#aws#infrastructure#security

Hi everyone, it's Shii-chan! Today I found a small but genuinely useful update for anyone replicating Kafka data, so let's dig in!

AWS What's New aws.amazon.com

What was announced?

This comes from AWS What's New. Amazon MSK Replicator now supports OAuth 2.0 (SASL/OAUTHBEARER) authentication when replicating from external Apache Kafka clusters into Amazon MSK Provisioned clusters. That covers external clusters running on-premises, self-managed on AWS, or hosted on other cloud providers.

MSK Replicator is the Amazon MSK feature that automates data replication between Kafka clusters, so you don't have to build and operate your own replication infrastructure or open-source tooling.

The story so far

Until now, MSK Replicator only supported SASL/SCRAM and mTLS authentication for connecting to external Kafka clusters. That meant external Kafka clusters configured with OAuth/OIDC authentication simply weren't reachable as a replication source.

What changes

External Kafka clusters using OAuth/OIDC authentication can now be replicated straight into Amazon MSK with MSK Replicator, unlocking scenarios like:

  • Migrating workloads from an external Kafka cluster to Amazon MSK
  • Using MSK-based clusters as a failover or backup target for disaster recovery
  • Distributing data across hybrid and multi-cloud environments

Unlike self-managed replication tools, MSK Replicator preserves your original Kafka topic names during replication and automatically avoids infinite replication loops. It also synchronizes consumer group offsets bidirectionally, so you can move producers and consumers between clusters independently, in any order, without coordination overhead or risking data loss.

Dive Deep

This new OAuth 2.0 support is available in every AWS Region where MSK Replicator is available. For setup details, check the Amazon MSK documentation.

Wrap-up

  • MSK Replicator now supports OAuth 2.0 (SASL/OAUTHBEARER) for connecting to external Kafka clusters
  • Joins the existing SASL/SCRAM and mTLS authentication options
  • External clusters using OAuth/OIDC can now migrate, feed DR setups, or distribute data across hybrid/multi-cloud environments
  • Available in all AWS Regions where MSK Replicator is supported

A handy update if your team runs Kafka with OAuth/OIDC and has been eyeing a move to Amazon MSK or a DR setup built on it!

Related posts