Configure a custom domain name for your Amazon MSK cluster enabled with IAM authentication

This article explains how to configure custom domain names for Amazon MSK clusters using IAM authentication with Network Load Balancers and Route 53.

• Uses NLB with ACM certificates to present custom domain names to Kafka clients
• Route 53 private hosted zone provides DNS resolution for custom domain names
• MSK broker advertised.listeners configuration updated to match custom domain and NLB ports
• Solution uses TLS encryption between client-NLB and NLB-broker for secure communication
• CloudFormation template automates deployment of VPC, NLB, PCA, ACM, MSK, and EC2 instance
• Script updates broker advertised.listeners after CloudFormation stack creation
• Truststore configuration required to validate private CA certificates for TLS handshake
• Solution only supported on Zookeeper-based MSK clusters, not KRaft-based clusters
• Scaling requires adding NLB listeners and updating certificates with new broker DNS names
• Broker failures automatically replaced without advertised.listeners configuration changes
• Multi-region MSK Replicator supported; requires region-specific bootstrap URLs for IAM authentication
• Public access requires internet-facing NLB, public subnets, and Route 53 public hosted zone

This solution enables custom domain names for IAM-authenticated MSK clusters, simplifying client configuration and supporting multi-VPC connectivity via PrivateLink.