Migrate an OAuth 2.0 authenticated Apache Kafka cluster to Amazon MSK with MSK Replicator

This article explains how to migrate OAuth 2.0-authenticated Apache Kafka clusters to Amazon MSK using MSK Replicator, covering the SASL/OAUTHBEARER handshake, three supported grant types, and deployment architecture.

• MSK Replicator supports CLIENT_CREDENTIALS, IAM_JWT_BEARER, and CLIENT_CREDENTIALS_ASSERTION grant types for OAuth authentication
• SASL/OAUTHBEARER handshake: Replicator obtains a signed JWT from the IdP and presents it to brokers, which verify it locally against cached JWKS keys
• Deployment requires interface VPC endpoints for Secrets Manager and STS, explicit network paths to external brokers and IdP, and proper TLS certificate configuration
• Service Execution Role must allow kafka.amazonaws.com to assume it with appropriate permissions for replication
• Federation-proxy pattern handles complex identity chains by collapsing multiple token-exchange hops behind a single OAuth endpoint
• Recommended setup order: pick grant type, prepare IdP, stage secrets, wire network, smoke-test, enable STS federation, build SER, create replicator, verify health metrics

The solution enables seamless migration of OAuth-authenticated Kafka clusters while maintaining security through JWT validation and supporting complex enterprise identity architectures.