> ## Documentation Index
> Fetch the complete documentation index at: https://www.qovery.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Amazon MSK

> Amazon MSK Serverless (managed Kafka) with SASL/IAM auth, attached to the Qovery cluster network

Qovery creates it in the AWS account of the environment's cluster, as a [Blueprint](https://www.qovery.com/docs/configuration/blueprints.md) service in one of your environments.

| | |
| - | - |
| Catalog name | `aws-msk` |
| Category | Messaging & Streaming |
| Provider | AWS |
| Engine | terraform |
| Major versions (latest release) | `default` (1.0.8) |
| Source | [AWS/msk/default](https://github.com/Qovery/service-catalog/tree/AWS/msk/default/1.0.8/AWS/msk/default) |

> [!TIP]
>
> **New to this?** You don't need to know Kubernetes or Terraform. Qovery sets up Amazon MSK in your cloud account and manages it for you: you fill in a form, or paste the prompt below into your coding agent. The values it publishes, listed under Outputs, reach your other services as environment variables. Qovery tells you when a newer version of the Blueprint is available. Check the requirements in the Reference section before you start, and try it first in a development environment.

## Create it

> [tab] Console
>
> 1. Open the environment, then **New service** › **Blueprint**.
> 2. Find **Amazon MSK** in the catalog and pick the major version.
> 3. Fill in the variables. Required ones are marked; the others use their defaults.
> 4. Create the service, and deploy it now or later.

> [tab] CLI and API
>
> List the catalog to get the latest tag, then create the service from it. `qovery api` signs the requests with your CLI session.
>
> ```bash theme={null}
> ORG_ID="REPLACE_WITH_ORGANIZATION_ID"
> ENV_ID="REPLACE_WITH_ENVIRONMENT_ID"
>
> qovery api "organization/$ORG_ID/blueprint/catalog" | jq '.. | objects | select(.name? == "aws-msk")'
>
> cat > blueprint.json <<'EOF'
> {
>   "name": "aws-msk",
>   "tag": "AWS/msk/default/1.0.8",
>   "icon": "app://qovery-console/amazon-msk",
>   "variables": [
>     {
>       "name": "cluster_name",
>       "value": "REPLACE_WITH_CLUSTER_NAME"
>     }
>   ],
>   "spec_overrides": {
>     "engine_version": "1.9.7"
>   }
> }
> EOF
> BLUEPRINT_ID=$(qovery api "environment/$ENV_ID/blueprint" --method POST --input - < blueprint.json | jq -r .id)
> rm blueprint.json   # it can hold secret values
> qovery api "blueprint/$BLUEPRINT_ID/deploy" --method POST
> qovery api "blueprint/$BLUEPRINT_ID"   # status of the latest deployment
> ```
>
> Replace each `REPLACE_WITH_` value. Add optional variables to `variables` the same way.

> [tab] Coding agent
>
> Paste this into Claude Code, Cursor, Codex or another coding agent with the [Qovery agent skills](https://www.qovery.com/docs/getting-started/quickstart/agent-skills.md) installed (`curl -fsSL https://skill.qovery.com/install.sh | bash`).
>
> ```text Prompt wrap theme={null}
> Add the Qovery Blueprint Amazon MSK (aws-msk) to one of my Qovery environments and deploy it. Ask me for cluster_name.
> Ask me before deploying to a production environment.
> Docs: https://www.qovery.com/docs/configuration/blueprints/aws-msk.md
> ```

You don't add any file to your repository. Qovery creates the Blueprint from the Console or the API.

## Variables and outputs

Generated from `qbm.yml` at `AWS/msk/default/1.0.8`, the manifest the Console form is built from.

> [accordion] All 3 variables
>
> | Name | Type | Required | Default | Secret | Description |
> | - | - | - | - | - | - |
> | `cluster_name` | string | Yes | | | Letters, digits, dots, hyphens, underscores; max 64 chars. |
> | `subnet_ids` | string | | | | Leave empty — discovered from the cluster's VPC subnets. Set it (comma-separated ids) only on a user-provided VPC. |
> | `security_group_ids` | string | | | | Leave empty — derived from the cluster's workers security group. Set it (comma-separated ids) only on a user-provided VPC. |

Outputs become environment variables that other services in the environment can use. By default Qovery also creates an alias for each output, prefixed with the Blueprint's name; see [Aliases Qovery creates for outputs](https://www.qovery.com/docs/configuration/environment-variables.md#aliases-qovery-creates-for-outputs) for the naming rules and the cases where no alias is created.

> [accordion] All 4 outputs
>
> | Name | Secret | Description |
> | - | - | - |
> | `cluster_arn` | | MSK Serverless cluster ARN |
> | `cluster_name` | | MSK Serverless cluster name |
> | `cluster_uuid` | | MSK cluster UUID (used in IAM resource ARNs) |
> | `bootstrap_brokers_sasl_iam` | | Bootstrap broker endpoints for SASL/IAM clients (connect target) |

## Reference

From the Blueprint's [README](https://github.com/Qovery/service-catalog/blob/AWS/msk/default/1.0.8/AWS/msk/default/README.md).

Provisions an [Amazon MSK Serverless](https://docs.aws.amazon.com/msk/latest/developerguide/serverless.html) cluster (`aws_msk_serverless_cluster`) — managed Apache Kafka with no broker sizing — via `hashicorp/aws` (`~> 5.0`).

### Credentials & networking

Uses the Qovery cluster's AWS credentials (`credentials.default: cluster`). By default the cluster attaches to the **Qovery cluster network**: the cluster VPC subnets and workers security group are auto-discovered via the `ClusterId` tag (like the managed RDS blueprints), so in-cluster apps can reach it. Override with `subnet_ids` / `security_group_ids` on clusters where the tag lookup doesn't resolve (user-provided VPC).

### Variables

#### Required

| Name | Type | Description |
| - | - | - |
| `cluster_name` | string | MSK Serverless cluster name (letters, digits, dots, hyphens, underscores; max 64) |

#### Network overrides

| Name | Type | Default | Description |
| - | - | - | - |
| `subnet_ids` | string | | Leave empty — discovered from the Qovery cluster's VPC subnets. Set it (comma-separated ids) only on a cluster with a user-provided VPC, where that lookup finds nothing. |
| `security_group_ids` | string | | Leave empty — derived from the Qovery cluster's workers security group. Set it (comma-separated ids) only on a cluster with a user-provided VPC, where that lookup finds nothing. |

### Outputs

| Name | Description |
| - | - |
| `cluster_arn` | MSK Serverless cluster ARN |
| `cluster_name` | Cluster name |
| `cluster_uuid` | Cluster UUID (used in IAM resource ARNs) |
| `bootstrap_brokers_sasl_iam` | Bootstrap brokers for SASL/IAM clients (connect target) |

### Notes

* **Auth is SASL/IAM only** (MSK Serverless requirement): clients authenticate with their AWS IAM identity — no static passwords. The consuming workload's IAM role needs `kafka-cluster:*` permissions scoped to the cluster ARN/UUID, and its security group must be allowed by the cluster SG on the Kafka ports.
* MSK Serverless does not create networking; it attaches to existing subnets/SG (auto-discovered here).
* Billed per-throughput + storage (no idle broker-hour cost, unlike provisioned MSK).

### Required AWS IAM permissions (to deploy)

```json theme={null}
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "kafka:CreateClusterV2",
        "kafka:DeleteCluster",
        "kafka:DescribeClusterV2",
        "kafka:TagResource",
        "kafka:UntagResource",
        "kafka:ListTagsForResource",
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeSecurityGroups"
      ],
      "Resource": "*"
    }
  ]
}
```


## Related topics

- [Blueprints](https://www.qovery.com/docs/configuration/blueprints.md)
- [Amazon S3](https://www.qovery.com/docs/configuration/blueprints/aws-s3.md)
- [Amazon MQ for RabbitMQ](https://www.qovery.com/docs/configuration/blueprints/aws-amazon-mq-rabbitmq.md)
- [Amazon RDS for MySQL](https://www.qovery.com/docs/configuration/blueprints/aws-rds-mysql.md)
- [Amazon RDS for PostgreSQL](https://www.qovery.com/docs/configuration/blueprints/aws-rds-postgresql.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.