aws-msk-iam-sasl-signer

aws-msk-iam-sasl-signer is a Rust library that produces the SASL authentication tokens needed to connect to Amazon MSK (Managed Streaming for Apache Kafka) using AWS IAM. It is a faithful port of AWS’s official aws-msk-iam-sasl-signer-go, giving Rust Kafka clients the same OAUTHBEARER token-generation capability.

The library resolves AWS credentials through aws-config, signs a presigned STS GetCallerIdentity URL with SigV4, and encodes it into the base64 token that MSK’s IAM SASL mechanism expects. It exposes token generation from the default credential chain, an explicit AWS profile, an assumed IAM role, or credentials provided directly — returning the token and its expiry for use in your Kafka client’s authentication callback.

What You Get

• Token generation from the default AWS credential provider chain
• Variants that sign using a named profile, an assumed role, or explicit credentials
• SigV4-signed presigned STS URLs encoded to the MSK IAM token format
• Both token string and expiry time returned for client callbacks
• A faithful Rust port of AWS’s official Go signer

Common Use Cases

• Authenticating a Rust Kafka producer or consumer to an Amazon MSK cluster via IAM
• Refreshing MSK SASL tokens on expiry inside a Kafka client callback
• Connecting to MSK using an assumed IAM role for cross-account access
• Signing MSK authentication with a specific AWS profile in multi-account setups

Under The Hood

Architecture — The crate is compact — essentially src/lib.rs plus src/error.rs and src/test.rs. The core flow builds a presigned STS GetCallerIdentity request, signs it with aws-sigv4, appends the MSK-specific query parameters (action, user-agent), and base64url-encodes the resulting URL into the OAUTHBEARER token, returning it with an expiry derived from the presign lifetime. Public functions vary only in how credentials are sourced (default chain, profile, assumed role, explicit), all funneling into the same signing routine.

Tech Stack — Pure Rust on the official AWS SDK crates: aws-config for credential resolution, aws-sdk-sts and aws-sigv4 for the presigned identity request, aws-credential-types and aws-types for credential plumbing, plus base64, chrono, url, futures, and thiserror for encoding, timing, and error handling. It runs on the tokio runtime.

Code Quality — Error handling is modeled explicitly with thiserror in a dedicated error module, an in-crate test module and CI workflow are present, and a CHANGELOG plus NOTICE file are maintained. The crate is small and single-purpose, which keeps it easy to audit despite limited community activity.

API Design — The API surface is minimal and closely tracks the well-documented Go original, so token generation is a single async call returning (token, expiry). The examples directory shows producer and consumer integrations, making it clear how to wire the signer into a Kafka client’s authentication callback with little boilerplate.