aws-sdk-kafka 1.118.0 → 1.119.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4a7c0c64bcc97f06e83fcf8dd6c274a5ab986199b596f4d41bb435f796e04283
-  data.tar.gz: 182fbc57fc64accc9b32774d861b68dbac6ea98c74e124d7b709165830d67199
+  metadata.gz: caa22ed9a548517b27e1c8b6e0b7813a252e09182feece3ceb8fa3d710c94419
+  data.tar.gz: a437b85a1d9eabc46d6f7821fb7ccff621ada0b86da9232bcdc8cd96a4dd5253
 SHA512:
-  metadata.gz: 1034566433df60a25d0bfce92cbbb4af7cce95818ed73e945c14f99a5a2839c51d28402eabfc6f31e0208b80213de52c6f2c483bc2ea6ba447d62a930022582c
-  data.tar.gz: 31a803106355b0b674184ebf45b7e1e6b090aa7ad7634e49c7350dfc84362ab07f2cbc0907dcd7819d7b8e37421b271b40b88c4dc91b8facaafec43957e2acc9
+  metadata.gz: 324b494209f06f4c935a06005a1e9efc0cf9d1508f8b7eb57f76af720d341f73cc0a5687d0f120ccc25c5f6a0ecab8d786b635ef51e7b3ba49627a8ea9bb98f6
+  data.tar.gz: 48248d720e40f86efb51ad2e1539b2218d2daee91279eeab8bc2a012ce13e7a7c9dc47c229f448a5a39a733e748f5645122ed96573b192f506f6f4c19bf163af

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.119.0 (2026-08-24)
+------------------
+
+* Feature - Amazon MSK Replicator now supports OAuth authentication when connecting to external Apache Kafka clusters, enabling customers to replicate data from clusters that require OAuth for client authentication. This new capability is supported in all AWS Regions where MSK Express brokers are available.
+
 1.118.0 (2026-08-06)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.118.0
+1.119.0

data/lib/aws-sdk-kafka/client.rb

@@ -1129,6 +1129,25 @@ module Aws::Kafka
     #           mtls: {
     #             secret_arn: "__string", # required
     #           },
+    #           sasl_o_auth_bearer: {
+    #             token_endpoint_url: "__string", # required
+    #             client_credentials: {
+    #               token_request_secret_arn: "__string", # required
+    #             },
+    #             iam_jwt_bearer: {
+    #               audience: "__string", # required
+    #               signing_algorithm: "RS256", # required, accepts RS256, ES384
+    #               token_request_secret_arn: "__string",
+    #             },
+    #             client_credentials_assertion: {
+    #               audience: "__string", # required
+    #               signing_algorithm: "RS256", # required, accepts RS256, ES384
+    #               token_request_secret_arn: "__string",
+    #             },
+    #             token_endpoint_authentication_method: "POST", # required, accepts POST, BASIC, NONE
+    #             scope: "__string",
+    #             token_endpoint_tls_certificate_arn: "__string",
+    #           },
     #         },
     #         encryption_in_transit: {
     #           encryption_type: "TLS", # required, accepts TLS
@@ -2195,6 +2214,17 @@ module Aws::Kafka
     #   resp.kafka_clusters[0].client_authentication.sasl_scram.mechanism #=> String, one of "SHA256", "SHA512"
     #   resp.kafka_clusters[0].client_authentication.sasl_scram.secret_arn #=> String
     #   resp.kafka_clusters[0].client_authentication.mtls.secret_arn #=> String
+    #   resp.kafka_clusters[0].client_authentication.sasl_o_auth_bearer.token_endpoint_url #=> String
+    #   resp.kafka_clusters[0].client_authentication.sasl_o_auth_bearer.client_credentials.token_request_secret_arn #=> String
+    #   resp.kafka_clusters[0].client_authentication.sasl_o_auth_bearer.iam_jwt_bearer.audience #=> String
+    #   resp.kafka_clusters[0].client_authentication.sasl_o_auth_bearer.iam_jwt_bearer.signing_algorithm #=> String, one of "RS256", "ES384"
+    #   resp.kafka_clusters[0].client_authentication.sasl_o_auth_bearer.iam_jwt_bearer.token_request_secret_arn #=> String
+    #   resp.kafka_clusters[0].client_authentication.sasl_o_auth_bearer.client_credentials_assertion.audience #=> String
+    #   resp.kafka_clusters[0].client_authentication.sasl_o_auth_bearer.client_credentials_assertion.signing_algorithm #=> String, one of "RS256", "ES384"
+    #   resp.kafka_clusters[0].client_authentication.sasl_o_auth_bearer.client_credentials_assertion.token_request_secret_arn #=> String
+    #   resp.kafka_clusters[0].client_authentication.sasl_o_auth_bearer.token_endpoint_authentication_method #=> String, one of "POST", "BASIC", "NONE"
+    #   resp.kafka_clusters[0].client_authentication.sasl_o_auth_bearer.scope #=> String
+    #   resp.kafka_clusters[0].client_authentication.sasl_o_auth_bearer.token_endpoint_tls_certificate_arn #=> String
     #   resp.kafka_clusters[0].encryption_in_transit.encryption_type #=> String, one of "TLS"
     #   resp.kafka_clusters[0].encryption_in_transit.root_ca_certificate #=> String
     #   resp.log_delivery.replicator_log_delivery.cloud_watch_logs.enabled #=> Boolean
@@ -4346,7 +4376,7 @@ module Aws::Kafka
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-kafka'
-      context[:gem_version] = '1.118.0'
+      context[:gem_version] = '1.119.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-kafka/client_api.rb

@@ -140,6 +140,7 @@ module Aws::Kafka
     InternalServerErrorException = Shapes::StructureShape.new(name: 'InternalServerErrorException')
     JmxExporter = Shapes::StructureShape.new(name: 'JmxExporter')
     JmxExporterInfo = Shapes::StructureShape.new(name: 'JmxExporterInfo')
+    JwtSigningAlgorithm = Shapes::StringShape.new(name: 'JwtSigningAlgorithm')
     KafkaCluster = Shapes::StructureShape.new(name: 'KafkaCluster')
     KafkaClusterClientAuthentication = Shapes::StructureShape.new(name: 'KafkaClusterClientAuthentication')
     KafkaClusterClientVpcConfig = Shapes::StructureShape.new(name: 'KafkaClusterClientVpcConfig')
@@ -147,6 +148,10 @@ module Aws::Kafka
     KafkaClusterEncryptionInTransit = Shapes::StructureShape.new(name: 'KafkaClusterEncryptionInTransit')
     KafkaClusterEncryptionInTransitType = Shapes::StringShape.new(name: 'KafkaClusterEncryptionInTransitType')
     KafkaClusterMTLSAuthentication = Shapes::StructureShape.new(name: 'KafkaClusterMTLSAuthentication')
+    KafkaClusterOAuthClientCredentials = Shapes::StructureShape.new(name: 'KafkaClusterOAuthClientCredentials')
+    KafkaClusterOAuthClientCredentialsAssertion = Shapes::StructureShape.new(name: 'KafkaClusterOAuthClientCredentialsAssertion')
+    KafkaClusterOAuthIamJwtBearer = Shapes::StructureShape.new(name: 'KafkaClusterOAuthIamJwtBearer')
+    KafkaClusterSaslOAuthBearerAuthentication = Shapes::StructureShape.new(name: 'KafkaClusterSaslOAuthBearerAuthentication')
     KafkaClusterSaslScramAuthentication = Shapes::StructureShape.new(name: 'KafkaClusterSaslScramAuthentication')
     KafkaClusterSaslScramMechanism = Shapes::StringShape.new(name: 'KafkaClusterSaslScramMechanism')
     KafkaClusterSummary = Shapes::StructureShape.new(name: 'KafkaClusterSummary')
@@ -253,6 +258,7 @@ module Aws::Kafka
     TagResourceRequest = Shapes::StructureShape.new(name: 'TagResourceRequest')
     TargetCompressionType = Shapes::StringShape.new(name: 'TargetCompressionType')
     Tls = Shapes::StructureShape.new(name: 'Tls')
+    TokenEndpointAuthenticationMethod = Shapes::StringShape.new(name: 'TokenEndpointAuthenticationMethod')
     TooManyRequestsException = Shapes::StructureShape.new(name: 'TooManyRequestsException')
     TopicConfiguration = Shapes::StructureShape.new(name: 'TopicConfiguration')
     TopicExistsException = Shapes::StructureShape.new(name: 'TopicExistsException')
@@ -1003,6 +1009,7 @@ module Aws::Kafka
 
     KafkaClusterClientAuthentication.add_member(:sasl_scram, Shapes::ShapeRef.new(shape: KafkaClusterSaslScramAuthentication, location_name: "saslScram"))
     KafkaClusterClientAuthentication.add_member(:mtls, Shapes::ShapeRef.new(shape: KafkaClusterMTLSAuthentication, location_name: "mTLS"))
+    KafkaClusterClientAuthentication.add_member(:sasl_o_auth_bearer, Shapes::ShapeRef.new(shape: KafkaClusterSaslOAuthBearerAuthentication, location_name: "saslOAuthBearer"))
     KafkaClusterClientAuthentication.struct_class = Types::KafkaClusterClientAuthentication
 
     KafkaClusterClientVpcConfig.add_member(:security_group_ids, Shapes::ShapeRef.new(shape: __listOf__string, location_name: "securityGroupIds"))
@@ -1024,6 +1031,28 @@ module Aws::Kafka
     KafkaClusterMTLSAuthentication.add_member(:secret_arn, Shapes::ShapeRef.new(shape: __string, required: true, location_name: "secretArn"))
     KafkaClusterMTLSAuthentication.struct_class = Types::KafkaClusterMTLSAuthentication
 
+    KafkaClusterOAuthClientCredentials.add_member(:token_request_secret_arn, Shapes::ShapeRef.new(shape: __string, required: true, location_name: "tokenRequestSecretArn"))
+    KafkaClusterOAuthClientCredentials.struct_class = Types::KafkaClusterOAuthClientCredentials
+
+    KafkaClusterOAuthClientCredentialsAssertion.add_member(:audience, Shapes::ShapeRef.new(shape: __string, required: true, location_name: "audience"))
+    KafkaClusterOAuthClientCredentialsAssertion.add_member(:signing_algorithm, Shapes::ShapeRef.new(shape: JwtSigningAlgorithm, required: true, location_name: "signingAlgorithm"))
+    KafkaClusterOAuthClientCredentialsAssertion.add_member(:token_request_secret_arn, Shapes::ShapeRef.new(shape: __string, location_name: "tokenRequestSecretArn"))
+    KafkaClusterOAuthClientCredentialsAssertion.struct_class = Types::KafkaClusterOAuthClientCredentialsAssertion
+
+    KafkaClusterOAuthIamJwtBearer.add_member(:audience, Shapes::ShapeRef.new(shape: __string, required: true, location_name: "audience"))
+    KafkaClusterOAuthIamJwtBearer.add_member(:signing_algorithm, Shapes::ShapeRef.new(shape: JwtSigningAlgorithm, required: true, location_name: "signingAlgorithm"))
+    KafkaClusterOAuthIamJwtBearer.add_member(:token_request_secret_arn, Shapes::ShapeRef.new(shape: __string, location_name: "tokenRequestSecretArn"))
+    KafkaClusterOAuthIamJwtBearer.struct_class = Types::KafkaClusterOAuthIamJwtBearer
+
+    KafkaClusterSaslOAuthBearerAuthentication.add_member(:token_endpoint_url, Shapes::ShapeRef.new(shape: __string, required: true, location_name: "tokenEndpointUrl"))
+    KafkaClusterSaslOAuthBearerAuthentication.add_member(:client_credentials, Shapes::ShapeRef.new(shape: KafkaClusterOAuthClientCredentials, location_name: "clientCredentials"))
+    KafkaClusterSaslOAuthBearerAuthentication.add_member(:iam_jwt_bearer, Shapes::ShapeRef.new(shape: KafkaClusterOAuthIamJwtBearer, location_name: "iamJwtBearer"))
+    KafkaClusterSaslOAuthBearerAuthentication.add_member(:client_credentials_assertion, Shapes::ShapeRef.new(shape: KafkaClusterOAuthClientCredentialsAssertion, location_name: "clientCredentialsAssertion"))
+    KafkaClusterSaslOAuthBearerAuthentication.add_member(:token_endpoint_authentication_method, Shapes::ShapeRef.new(shape: TokenEndpointAuthenticationMethod, required: true, location_name: "tokenEndpointAuthenticationMethod"))
+    KafkaClusterSaslOAuthBearerAuthentication.add_member(:scope, Shapes::ShapeRef.new(shape: __string, location_name: "scope"))
+    KafkaClusterSaslOAuthBearerAuthentication.add_member(:token_endpoint_tls_certificate_arn, Shapes::ShapeRef.new(shape: __string, location_name: "tokenEndpointTlsCertificateArn"))
+    KafkaClusterSaslOAuthBearerAuthentication.struct_class = Types::KafkaClusterSaslOAuthBearerAuthentication
+
     KafkaClusterSaslScramAuthentication.add_member(:mechanism, Shapes::ShapeRef.new(shape: KafkaClusterSaslScramMechanism, required: true, location_name: "mechanism"))
     KafkaClusterSaslScramAuthentication.add_member(:secret_arn, Shapes::ShapeRef.new(shape: __string, required: true, location_name: "secretArn"))
     KafkaClusterSaslScramAuthentication.struct_class = Types::KafkaClusterSaslScramAuthentication

data/lib/aws-sdk-kafka/types.rb

@@ -2848,11 +2848,134 @@ module Aws::Kafka
     #   Details for mTLS client authentication.
     #   @return [Types::KafkaClusterMTLSAuthentication]
     #
+    # @!attribute [rw] sasl_o_auth_bearer
+    #   Details for SASL/OAUTHBEARER client authentication.
+    #   @return [Types::KafkaClusterSaslOAuthBearerAuthentication]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/kafka-2018-11-14/KafkaClusterClientAuthentication AWS API Documentation
     #
     class KafkaClusterClientAuthentication < Struct.new(
       :sasl_scram,
-      :mtls)
+      :mtls,
+      :sasl_o_auth_bearer)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Details for SASL/OAUTHBEARER client authentication.
+    #
+    # @!attribute [rw] token_endpoint_url
+    #   The HTTPS URL of the OAuth token endpoint that vends OAuth Bearer
+    #   tokens per RFC 6749.
+    #   @return [String]
+    #
+    # @!attribute [rw] client_credentials
+    #   Details for SASL/OAUTHBEARER using standard client\_credentials
+    #   grant.
+    #   @return [Types::KafkaClusterOAuthClientCredentials]
+    #
+    # @!attribute [rw] iam_jwt_bearer
+    #   Details for SASL/OAUTHBEARER using JWT Bearer assertion grant.
+    #   @return [Types::KafkaClusterOAuthIamJwtBearer]
+    #
+    # @!attribute [rw] client_credentials_assertion
+    #   Details for SASL/OAUTHBEARER using client credentials grant with JWT
+    #   client assertion.
+    #   @return [Types::KafkaClusterOAuthClientCredentialsAssertion]
+    #
+    # @!attribute [rw] token_endpoint_authentication_method
+    #   How client credentials are sent to the identity provider. Valid
+    #   values are POST, BASIC, or NONE.
+    #   @return [String]
+    #
+    # @!attribute [rw] scope
+    #   OAuth scope to request. Included in the token request if provided.
+    #   @return [String]
+    #
+    # @!attribute [rw] token_endpoint_tls_certificate_arn
+    #   Secrets Manager ARN containing a custom CA certificate for the
+    #   identity provider. Required only if the identity provider uses a
+    #   private CA.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kafka-2018-11-14/KafkaClusterSaslOAuthBearerAuthentication AWS API Documentation
+    #
+    class KafkaClusterSaslOAuthBearerAuthentication < Struct.new(
+      :token_endpoint_url,
+      :client_credentials,
+      :iam_jwt_bearer,
+      :client_credentials_assertion,
+      :token_endpoint_authentication_method,
+      :scope,
+      :token_endpoint_tls_certificate_arn)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Details for SASL/OAUTHBEARER using standard client\_credentials grant
+    # (RFC 6749).
+    #
+    # @!attribute [rw] token_request_secret_arn
+    #   The Amazon Resource Name (ARN) of the Secrets Manager secret
+    #   containing the OAuth client credentials.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kafka-2018-11-14/KafkaClusterOAuthClientCredentials AWS API Documentation
+    #
+    class KafkaClusterOAuthClientCredentials < Struct.new(
+      :token_request_secret_arn)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Details for SASL/OAUTHBEARER using JWT Bearer assertion grant (RFC
+    # 7523).
+    #
+    # @!attribute [rw] audience
+    #   The audience for the JWT Bearer assertion.
+    #   @return [String]
+    #
+    # @!attribute [rw] signing_algorithm
+    #   The signing algorithm for the JWT Bearer assertion.
+    #   @return [String]
+    #
+    # @!attribute [rw] token_request_secret_arn
+    #   The Amazon Resource Name (ARN) of the Secrets Manager secret
+    #   containing the signing key.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kafka-2018-11-14/KafkaClusterOAuthIamJwtBearer AWS API Documentation
+    #
+    class KafkaClusterOAuthIamJwtBearer < Struct.new(
+      :audience,
+      :signing_algorithm,
+      :token_request_secret_arn)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # Details for SASL/OAUTHBEARER using client credentials grant with JWT
+    # client assertion (RFC 7521/7523).
+    #
+    # @!attribute [rw] audience
+    #   The audience for the JWT client assertion.
+    #   @return [String]
+    #
+    # @!attribute [rw] signing_algorithm
+    #   The signing algorithm for the JWT client assertion.
+    #   @return [String]
+    #
+    # @!attribute [rw] token_request_secret_arn
+    #   The Amazon Resource Name (ARN) of the Secrets Manager secret
+    #   containing the signing key.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/kafka-2018-11-14/KafkaClusterOAuthClientCredentialsAssertion AWS API Documentation
+    #
+    class KafkaClusterOAuthClientCredentialsAssertion < Struct.new(
+      :audience,
+      :signing_algorithm,
+      :token_request_secret_arn)
       SENSITIVE = []
       include Aws::Structure
     end

data/lib/aws-sdk-kafka.rb

@@ -54,7 +54,7 @@ module Aws::Kafka
   autoload :EndpointProvider, 'aws-sdk-kafka/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-kafka/endpoints'
 
-  GEM_VERSION = '1.118.0'
+  GEM_VERSION = '1.119.0'
 
 end
 

data/sig/client.rbs

@@ -306,6 +306,25 @@ module Aws
                                      }?,
                                      mtls: {
                                        secret_arn: ::String
+                                     }?,
+                                     sasl_o_auth_bearer: {
+                                       token_endpoint_url: ::String,
+                                       client_credentials: {
+                                         token_request_secret_arn: ::String
+                                       }?,
+                                       iam_jwt_bearer: {
+                                         audience: ::String,
+                                         signing_algorithm: ("RS256" | "ES384"),
+                                         token_request_secret_arn: ::String?
+                                       }?,
+                                       client_credentials_assertion: {
+                                         audience: ::String,
+                                         signing_algorithm: ("RS256" | "ES384"),
+                                         token_request_secret_arn: ::String?
+                                       }?,
+                                       token_endpoint_authentication_method: ("POST" | "BASIC" | "NONE"),
+                                       scope: ::String?,
+                                       token_endpoint_tls_certificate_arn: ::String?
                                      }?
                                    }?,
                                    encryption_in_transit: {

data/sig/types.rbs

@@ -781,6 +781,37 @@ module Aws::Kafka
     class KafkaClusterClientAuthentication
       attr_accessor sasl_scram: Types::KafkaClusterSaslScramAuthentication
       attr_accessor mtls: Types::KafkaClusterMTLSAuthentication
+      attr_accessor sasl_o_auth_bearer: Types::KafkaClusterSaslOAuthBearerAuthentication
+      SENSITIVE: []
+    end
+
+    class KafkaClusterSaslOAuthBearerAuthentication
+      attr_accessor token_endpoint_url: ::String
+      attr_accessor client_credentials: Types::KafkaClusterOAuthClientCredentials
+      attr_accessor iam_jwt_bearer: Types::KafkaClusterOAuthIamJwtBearer
+      attr_accessor client_credentials_assertion: Types::KafkaClusterOAuthClientCredentialsAssertion
+      attr_accessor token_endpoint_authentication_method: ("POST" | "BASIC" | "NONE")
+      attr_accessor scope: ::String
+      attr_accessor token_endpoint_tls_certificate_arn: ::String
+      SENSITIVE: []
+    end
+
+    class KafkaClusterOAuthClientCredentials
+      attr_accessor token_request_secret_arn: ::String
+      SENSITIVE: []
+    end
+
+    class KafkaClusterOAuthIamJwtBearer
+      attr_accessor audience: ::String
+      attr_accessor signing_algorithm: ("RS256" | "ES384")
+      attr_accessor token_request_secret_arn: ::String
+      SENSITIVE: []
+    end
+
+    class KafkaClusterOAuthClientCredentialsAssertion
+      attr_accessor audience: ::String
+      attr_accessor signing_algorithm: ("RS256" | "ES384")
+      attr_accessor token_request_secret_arn: ::String
       SENSITIVE: []
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-kafka
 version: !ruby/object:Gem::Version
-  version: 1.118.0
+  version: 1.119.0
 platform: ruby
 authors:
 - Amazon Web Services