Amazon MSK

Qovery creates it in the AWS account of the environment’s cluster, as a Blueprint service in one of your environments.


Catalog name	`aws-msk`
Category	Messaging & Streaming
Provider	AWS
Engine	terraform
Major versions (latest release)	`default` (1.0.8)
Source	AWS/msk/default

New to this? You don’t need to know Kubernetes or Terraform. Qovery sets up Amazon MSK in your cloud account and manages it for you: you fill in a form, or paste the prompt below into your coding agent. The values it publishes, listed under Outputs, reach your other services as environment variables. Qovery tells you when a newer version of the Blueprint is available. Check the requirements in the Reference section before you start, and try it first in a development environment.

Create it

Console
CLI and API
Coding agent

Open the environment, then New service › Blueprint.
Find Amazon MSK in the catalog and pick the major version.
Fill in the variables. Required ones are marked; the others use their defaults.
Create the service, and deploy it now or later.

List the catalog to get the latest tag, then create the service from it. qovery api signs the requests with your CLI session.

ORG_ID="REPLACE_WITH_ORGANIZATION_ID"
ENV_ID="REPLACE_WITH_ENVIRONMENT_ID"

qovery api "organization/$ORG_ID/blueprint/catalog" | jq '.. | objects | select(.name? == "aws-msk")'

cat > blueprint.json <<'EOF'
{
  "name": "aws-msk",
  "tag": "AWS/msk/default/1.0.8",
  "icon": "app://qovery-console/amazon-msk",
  "variables": [
    {
      "name": "cluster_name",
      "value": "REPLACE_WITH_CLUSTER_NAME"
    }
  ],
  "spec_overrides": {
    "engine_version": "1.9.7"
  }
}
EOF
BLUEPRINT_ID=$(qovery api "environment/$ENV_ID/blueprint" --method POST --input - < blueprint.json | jq -r .id)
rm blueprint.json   # it can hold secret values
qovery api "blueprint/$BLUEPRINT_ID/deploy" --method POST
qovery api "blueprint/$BLUEPRINT_ID"   # status of the latest deployment

Replace each REPLACE_WITH_ value. Add optional variables to variables the same way.

Paste this into Claude Code, Cursor, Codex or another coding agent with the Qovery agent skills installed (curl -fsSL https://skill.qovery.com/install.sh | bash).

Prompt

Add the Qovery Blueprint Amazon MSK (aws-msk) to one of my Qovery environments and deploy it. Ask me for cluster_name.
Ask me before deploying to a production environment.
Docs: https://www.qovery.com/docs/configuration/blueprints/aws-msk.md

You don’t add any file to your repository. Qovery creates the Blueprint from the Console or the API.

Variables and outputs

Generated from qbm.yml at AWS/msk/default/1.0.8, the manifest the Console form is built from.

All 3 variables

Name	Type	Required	Description
`cluster_name`	string	Yes	Letters, digits, dots, hyphens, underscores; max 64 chars.
`subnet_ids`	string		Leave empty — discovered from the cluster’s VPC subnets. Set it (comma-separated ids) only on a user-provided VPC.
`security_group_ids`	string		Leave empty — derived from the cluster’s workers security group. Set it (comma-separated ids) only on a user-provided VPC.

Outputs become environment variables that other services in the environment can use. By default Qovery also creates an alias for each output, prefixed with the Blueprint’s name; see Aliases Qovery creates for outputs for the naming rules and the cases where no alias is created.

All 4 outputs

Name	Secret	Description
`cluster_arn`		MSK Serverless cluster ARN
`cluster_name`		MSK Serverless cluster name
`cluster_uuid`		MSK cluster UUID (used in IAM resource ARNs)
`bootstrap_brokers_sasl_iam`		Bootstrap broker endpoints for SASL/IAM clients (connect target)

Reference

From the Blueprint’s README. Provisions an Amazon MSK Serverless cluster (aws_msk_serverless_cluster) — managed Apache Kafka with no broker sizing — via hashicorp/aws (~> 5.0).

Credentials & networking

Uses the Qovery cluster’s AWS credentials (credentials.default: cluster). By default the cluster attaches to the Qovery cluster network: the cluster VPC subnets and workers security group are auto-discovered via the ClusterId tag (like the managed RDS blueprints), so in-cluster apps can reach it. Override with subnet_ids / security_group_ids on clusters where the tag lookup doesn’t resolve (user-provided VPC).

Variables

Required

Name	Type	Description
`cluster_name`	string	MSK Serverless cluster name (letters, digits, dots, hyphens, underscores; max 64)

Network overrides

Name	Type	Default	Description
`subnet_ids`	string		Leave empty — discovered from the Qovery cluster’s VPC subnets. Set it (comma-separated ids) only on a cluster with a user-provided VPC, where that lookup finds nothing.
`security_group_ids`	string		Leave empty — derived from the Qovery cluster’s workers security group. Set it (comma-separated ids) only on a cluster with a user-provided VPC, where that lookup finds nothing.

Outputs

Name	Description
`cluster_arn`	MSK Serverless cluster ARN
`cluster_name`	Cluster name
`cluster_uuid`	Cluster UUID (used in IAM resource ARNs)
`bootstrap_brokers_sasl_iam`	Bootstrap brokers for SASL/IAM clients (connect target)

Notes

Auth is SASL/IAM only (MSK Serverless requirement): clients authenticate with their AWS IAM identity — no static passwords. The consuming workload’s IAM role needs kafka-cluster:* permissions scoped to the cluster ARN/UUID, and its security group must be allowed by the cluster SG on the Kafka ports.
MSK Serverless does not create networking; it attaches to existing subnets/SG (auto-discovered here).
Billed per-throughput + storage (no idle broker-hour cost, unlike provisioned MSK).

Required AWS IAM permissions (to deploy)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kafka:CreateClusterV2",
        "kafka:DeleteCluster",
        "kafka:DescribeClusterV2",
        "kafka:TagResource",
        "kafka:UntagResource",
        "kafka:ListTagsForResource",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups"
      ],
      "Resource": "*"
    }
  ]
}

Overview

Account & Organization

Clusters & Cloud

Source Control

Projects & Environments

Services

Deployment & CI/CD

Environment Variables & Secrets

Observability

Notifications

Networking & Advanced

Create it

Variables and outputs

Reference

Credentials & networking

Variables

Required

Network overrides

Outputs

Notes

Required AWS IAM permissions (to deploy)

​Create it

​Variables and outputs

​Reference

​Credentials & networking

​Variables

​Required

​Network overrides

​Outputs

​Notes

​Required AWS IAM permissions (to deploy)

Create it

Variables and outputs

Reference

Credentials & networking

Variables

Required

Network overrides

Outputs

Notes

Required AWS IAM permissions (to deploy)