Package com.pulumi.aws.msk

Class ScramSecretAssociation

  • public class ScramSecretAssociation
extends com.pulumi.resources.CustomResource
    Associates SCRAM secrets stored in the Secrets Manager service with a Managed Streaming for Kafka (MSK) cluster. > This resource takes exclusive ownership over SCRAM secrets associated with a cluster. This includes removal of SCRAM secrets which are not explicitly configured. To prevent persistent drift, ensure any `aws.msk.SingleScramSecretAssociation` resources managed alongside this resource are included in the `secretArnList` argument. > **Note:** The following assumes the MSK cluster has SASL/SCRAM authentication enabled. See below for example usage or refer to the [Username/Password Authentication](https://docs.aws.amazon.com/msk/latest/developerguide/msk-password.html) section of the MSK Developer Guide for more details. To set up username and password authentication for a cluster, create an `aws.secretsmanager.Secret` resource and associate a username and password with the secret with an `aws.secretsmanager.SecretVersion` resource. When creating a secret for the cluster, the `name` must have the prefix `AmazonMSK_` and you must either use an existing custom AWS KMS key or create a new custom AWS KMS key for your secret with the `aws.kms.Key` resource. It is important to note that a policy is required for the `aws.secretsmanager.Secret` resource in order for Kafka to be able to read it. This policy is attached automatically when the `aws.msk.ScramSecretAssociation` is used, however, this policy will not be in the state and as such, will present a diff on plan/apply. For that reason, you must use the `aws.secretsmanager.SecretPolicy` resource](/docs/providers/aws/r/secretsmanager_secret_policy.html) as shown below in order to ensure that the state is in a clean state after the creation of secret and the association to the cluster. ## Example Usage 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.msk.Cluster;
 import com.pulumi.aws.msk.ClusterArgs;
 import com.pulumi.aws.msk.inputs.ClusterClientAuthenticationArgs;
 import com.pulumi.aws.msk.inputs.ClusterClientAuthenticationSaslArgs;
 import com.pulumi.aws.kms.Key;
 import com.pulumi.aws.kms.KeyArgs;
 import com.pulumi.aws.secretsmanager.Secret;
 import com.pulumi.aws.secretsmanager.SecretArgs;
 import com.pulumi.aws.secretsmanager.SecretVersion;
 import com.pulumi.aws.secretsmanager.SecretVersionArgs;
 import com.pulumi.aws.msk.ScramSecretAssociation;
 import com.pulumi.aws.msk.ScramSecretAssociationArgs;
 import com.pulumi.aws.iam.IamFunctions;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementArgs;
 import com.pulumi.aws.iam.inputs.GetPolicyDocumentStatementPrincipalArgs;
 import com.pulumi.aws.secretsmanager.SecretPolicy;
 import com.pulumi.aws.secretsmanager.SecretPolicyArgs;
 import static com.pulumi.codegen.internal.Serialization.*;
 import com.pulumi.resources.CustomResourceOptions;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var exampleCluster = new Cluster("exampleCluster", ClusterArgs.builder()
             .clientAuthentication(ClusterClientAuthenticationArgs.builder()
                 .sasl(ClusterClientAuthenticationSaslArgs.builder()
                     .scram(true)
                     .build())
                 .build())
             .clusterName("example")
             .build());
 
         var exampleKey = new Key("exampleKey", KeyArgs.builder()
             .description("Example Key for MSK Cluster Scram Secret Association")
             .build());
 
         var exampleSecret = new Secret("exampleSecret", SecretArgs.builder()
             .name("AmazonMSK_example")
             .kmsKeyId(exampleKey.keyId())
             .build());
 
         var exampleSecretVersion = new SecretVersion("exampleSecretVersion", SecretVersionArgs.builder()
             .secretId(exampleSecret.id())
             .secretString(serializeJson(
                 jsonObject(
                     jsonProperty("username", "user"),
                     jsonProperty("password", "pass")
                 )))
             .build());
 
         var exampleScramSecretAssociation = new ScramSecretAssociation("exampleScramSecretAssociation", ScramSecretAssociationArgs.builder()
             .clusterArn(exampleCluster.arn())
             .secretArnLists(exampleSecret.arn())
             .build(), CustomResourceOptions.builder()
                 .dependsOn(exampleSecretVersion)
                 .build());
 
         final var example = IamFunctions.getPolicyDocument(GetPolicyDocumentArgs.builder()
             .statements(GetPolicyDocumentStatementArgs.builder()
                 .principals(GetPolicyDocumentStatementPrincipalArgs.builder()
                     .type("Service")
                     .identifiers("kafka.amazonaws.com")
                     .build())
                 .sid("AWSKafkaResourcePolicy")
                 .effect("Allow")
                 .actions("secretsmanager:getSecretValue")
                 .resources(exampleSecret.arn())
                 .build())
             .build());
 
         var exampleSecretPolicy = new SecretPolicy("exampleSecretPolicy", SecretPolicyArgs.builder()
             .secretArn(exampleSecret.arn())
             .policy(example.applyValue(_example -> _example.json()))
             .build());
 
     }
 }
    ## Import Using `pulumi import`, import MSK SCRAM Secret Associations using the `id`. For example: ```sh $ pulumi import aws:msk/scramSecretAssociation:ScramSecretAssociation example arn:aws:kafka:us-west-2:123456789012:cluster/example/279c0212-d057-4dba-9aa9-1c4e5a25bfc7-3 ```

    • Nested Class Summary

      • Nested classes/interfaces inherited from class com.pulumi.resources.CustomResource

        com.pulumi.resources.CustomResource.CustomResourceInternal

      • Nested classes/interfaces inherited from class com.pulumi.resources.Resource

        com.pulumi.resources.Resource.LazyField<T extends java.lang.Object>, com.pulumi.resources.Resource.LazyFields, com.pulumi.resources.Resource.ResourceInternal

    • Field Summary

      • Fields inherited from class com.pulumi.resources.Resource

        childResources, remote

    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      com.pulumi.core.Output<java.lang.String> clusterArn()  
      static ScramSecretAssociation get​(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, ScramSecretAssociationState state, com.pulumi.resources.CustomResourceOptions options)
      Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
      com.pulumi.core.Output<java.lang.String> region()  
      com.pulumi.core.Output<java.util.List<java.lang.String>> secretArnLists()  

      • Methods inherited from class com.pulumi.resources.CustomResource

        getId, id, idFuture

      • Methods inherited from class com.pulumi.resources.Resource

        getChildResources, getResourceName, getResourceType, getUrn, pulumiChildResources, pulumiResourceName, pulumiResourceType, urn

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • ScramSecretAssociation

        public ScramSecretAssociation​(java.lang.String name)
        Parameters:
        name - The _unique_ name of the resulting resource.

      • ScramSecretAssociation

        public ScramSecretAssociation​(java.lang.String name,
                              ScramSecretAssociationArgs args)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.

      • ScramSecretAssociation

        public ScramSecretAssociation​(java.lang.String name,
                              ScramSecretAssociationArgs args,
                              @Nullable
                              com.pulumi.resources.CustomResourceOptions options)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
        options - A bag of options that control this resource's behavior.

    • Method Detail

      • clusterArn

        public com.pulumi.core.Output<java.lang.String> clusterArn()
        Returns:
        ARN of the MSK cluster.

      • region

        public com.pulumi.core.Output<java.lang.String> region()
        Returns:
        Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.

      • secretArnLists

        public com.pulumi.core.Output<java.util.List<java.lang.String>> secretArnLists()
        Returns:
        List of AWS Secrets Manager secret ARNs.

      • get

        public static ScramSecretAssociation get​(java.lang.String name,
                                         com.pulumi.core.Output<java.lang.String> id,
                                         @Nullable
                                         ScramSecretAssociationState state,
                                         @Nullable
                                         com.pulumi.resources.CustomResourceOptions options)
        Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
        Parameters:
        name - The _unique_ name of the resulting resource.
        id - The _unique_ provider ID of the resource to lookup.
        state -
        options - Optional settings to control the behavior of the CustomResource.