search

segmentio / topicctl

Tool for declarative management of Kafka topics
MIT License
590 stars 55 forks source link

Allow assuming an AWS role in AWS MSK IAM flow #64

Open ghost opened 2 years ago

ghost commented 2 years ago

I'm integrating your tool into my AWS Kafka infrastructure, and so far it looks like a great fit, but I've stumbled upon a (seemingly) missing feature that I think could be useful.

We have a bunch of Kafka clusters in different regions, so instead of creating separate local AWS profiles for them we use a unified profile with explicit --assume-role for each of the regions/accounts. I can't make it work with topicctl though: AWS_ROLE_ARN is not documented in the AWS Go SDK and doesn't seem to do anything. The only way I could find was generating a bunch of profiles for each of the roles, which quickly gets out of hands.

There appears to be a way to assume a role programmatically in the SDK, so I'm wondering if you could offer an extra configuration option for mechanism: AWS-MSK-IAM, such as assume-role? It'd help a lot.

yolken commented 2 years ago

Yup, this shouldn't be too bad. I can take a look in a few days unless someone else wants to help and do it before then.

yolken commented 2 years ago

Ok, I have a draft of a fix in https://github.com/segmentio/topicctl/pull/67. Can you give it a try and let me know whether it works for you? Unfortunately, I don't have access to an MSK cluster at the moment to test it on. Thanks.