title: AWS MSK Public cluster secured with SASL/SCRAM
body: <p>I configured an AWS MSK cluster with public access. I created an AWS Secret via Secrets Manager and assigned it to the cluster.</p>
  <p>Based on that secret, I managed to publish messages to MSK (I think). However, when I try to read messages from the topic, I get unauthorized errors.</p>
  <p>I followed <a href="https://docs.aws.amazon.com/msk/latest/developerguide/msk-password.html" rel="nofollow noreferrer">this</a> documentation page, and I ended up with the following settings:</p>
  <ul>
  <li><code>user_jaas.conf</code></li>
  </ul>
  <pre><code>KafkaClient {
     org.apache.kafka.common.security.scram.ScramLoginModule required
     username=&quot;&lt;username&gt;&quot;
     password=&quot;&lt;password&gt;&quot;;
  };
  </code></pre>
  <ul>
  <li><code>config.properties</code></li>
  </ul>
  <pre><code>security.protocol=SASL_SSL
  sasl.mechanism=SCRAM-SHA-512
  </code></pre>
  <ul>
  <li><code>export KAFKA_OPTS=-Djava.security.auth.login.config=/home/ec2-user/user_jaas.conf</code></li>
  </ul>
  <p>Then, I'm using the consumer shell script as follows:</p>
  <pre><code>./kafka-console-consumer.sh --bootstrap-server &lt;urls&gt; --topic &lt;topicName&gt; --from-beginning --consumer.config client.properties
  </code></pre>
  <p>And I'm getting the following error:</p>
  <blockquote>
  <p>[2022-06-21 13:34:17,566] WARN [Consumer clientId=consumer-console-consumer-13840-1, groupId=console-consumer-13840] Error while fetching metadata with correlation id 2 : {users=TOPIC_AUTHORIZATION_FAILED} (org.apache.kafka.clients.NetworkClient)
  [2022-06-21 13:34:17,568] ERROR [Consumer clientId=consumer-console-consumer-13840-1, groupId=console-consumer-13840] Topic authorization failed for topics [topicName] (org.apache.kafka.clients.Metadata)
  [2022-06-21 13:34:17,571] ERROR Error processing message, terminating consumer process:  (kafka.tools.ConsoleConsumer$)
  org.apache.kafka.common.errors.TopicAuthorizationException: Not authorized to access topics: [topicName]
  Processed a total of 0 messages</p>
  </blockquote>
  <p>Am I missing an important aspect of the documentation?</p>