Set Up an Amazon MSK Connection

Create an Amazon Managed Streaming Kafka connection to pull data from Amazon MSK data streams into Data 360.

User Permissions Needed
To create an Amazon Managed Streaming Kafka connection:	System Admin profile or Data Cloud Architect permission set

Requirements:

Firewall: If the MSK instance you want to connect to is behind a network firewall, add these Data 360 IP addresses to your allowlist before creating a connection.

In Data Cloud, click Setup, and select Data Cloud Setup.
Under External Integrations, select Other Connectors.
Click New.
On the Source tab, select Amazon MSK and click Next.
Enter a connection name and a connection API name.
If you want to privately connect to the Amazon MSK instance and a Private Network Route (PNR) for the instance has not been configured, see Add a Private Network Route for Amazon MSK. If a PNR has already been created, toggle Use Private Network Route and select the appropriate PNR.
If you want to use key-based authentication, click Access Key/Secret based and enter the necessary information.

If you’re using key-based authentication, skip the next step and continue configuring your Kafka data stream.

If you want to use identity provider-based authentication, click Identity Provider Based.

In the AWS IAM dashboard, select Identity providers, and click Add provider.

Enter the required information and then click Add Provider.

Item	What to Enter	Example
Provider type	OpenID Connect
Provider URL	My Domain URL/services/connectors	https://yourcompany.my.salesforce.com/services/connectors
Audience	My Domain URL	https://yourcompany.my.salesforce.com

In AWS IAM create a role to provide access to IAM users.

For Trusted Entity Type, select Web Identity.
Select the provider and audience that you created.

Create a JSON permission policy document for the role that you are creating. Use this JSON blurb to define the required permissions.

1{
2"Version": "2012-10-17"
3
4 "Statement": [
5    {
6        "Effect": "Allow",
7        "Action": [
8            "kafka-cluster:Connect",
9            "kafka-cluster:DescribeCluster",
10        ],
11        "Resource":
12    "arn:aws:kafka:us-west-2:240852588578:cluster/cdp-streaming-kafka-*/*"
13        },
14        {
15        "Effect": "Allow",
16        "Action": [
17            "kafka-cluster:DescribeTopic",
18            "kafka-cluster:ReadData",
19        ],
20        "Resource":
21    "arn:aws:kafka:us-west-2:240852588578:topic/cdp-streaming-kafka-*/*"
22        },
23        {
24        "Effect": "Allow",
25        "Action": [
26            "kafka-cluster:AlterGroup",
27            "kafka-cluster:DescribeGroup",
28        ],
29        "Resource":
30    "arn:aws:kafka:us-west-2:240852588578:group/cdp-streaming-kafka-*/*"
31        }
32     ]
33}

Enter a name for the role, and click Create role.

From Data Cloud, copy the External ID.
On the IAM role page’s Trust relationship tab, click Edit trust policy.

In the JSON blurb, replace {external_app_id} with the Data Cloud External ID.

1{
2    "Version": "2012-10-17",
3
4    "Statement": [
5    {
6        "Effect": "Allow",
7        "Principal": {
8            "Federated": "arn:aws:iam::240852588578:oidc-provider/yourcompany.my.salesforce.com/services/connectors/services/connectors"
9    },
10    "Action": "sts:AssumeRoleWithWebIdentity",
11    "Condition": {
12        "StringEquals": {
13            "yourcompany.my.salesforce.com/services/connectors:sub": "{external_app_id}"
14                }
15            }
16        }
17    ]
18}

From AWS IAM, copy the role’s Amazon Resource Name.
In Data Cloud, enter the Amazon Resource Name in the IAM Role Name field.

If the Use Private Network Route option is not toggled, specify a comma-delimited list of MSK bootstrap servers. An MSK bootstrap server serves as an entry point for a client to connect to an MSK cluster. See Get the bootstrap brokers using the AWS Management Console
To review your configuration, click Test Connection.
Click Save.
Upload a schema using the Upload Files button in the Schema section of the connector.
Verify the schema in the Preview Schema window and click Save.

After the connector details are accepted, the connection is created and ready to use. It’s listed under Other Connectors.

A Data Aware Specialist can now create data streams.

Considerations

YAML vs. JSON: While the schema of the objects are defined in the YAML mentioned above, each record in your MSK data stream must be a flat JSON object.
Schema Registry: The MSK connector doesn’t support connecting to a schema registry, for example AWS Glue. To evolve the schema of your MSK data streams, upload a new YAML file with only additive changes (no field removals). Records with schemas differing from the registered one in Data 360 won’t be ingested.

Next Step

Create an Amazon MSK Data Stream