使用更新 Amazon MSK 集群安全设置 Amazon CLI

创建一个 JSON 文件，内含您希望集群具有的加密设置。示例如下：

{"EncryptionInTransit":{"ClientBroker": "TLS"}}

创建一个 JSON 文件，内含您希望集群具有的身份验证设置。示例如下：

{"Sasl":{"Scram":{"Enabled":true}}}

运行以下 Amazon CLI 命令：

aws kafka update-security --cluster-arn ClusterArn --current-version Current-Cluster-Version --client-authentication file://Path-to-Authentication-Settings-JSON-File --encryption-info file://Path-to-Encryption-Settings-JSON-File

该 update-security 操作的输出如以下 JSON 所示：

{
    
    "ClusterArn": "arn:aws:kafka:us-east-1:012345678012:cluster/exampleClusterName/abcdefab-1234-abcd-5678-cdef0123ab01-2",
    "ClusterOperationArn": "arn:aws:kafka:us-east-1:012345678012:cluster-operation/exampleClusterName/abcdefab-1234-abcd-5678-cdef0123ab01-2/0123abcd-abcd-4f7f-1234-9876543210ef"
}

要查看update-security操作的状态，请运行以下命令，ClusterOperationArn替换为在命令输出中获得的 ARN。update-security

aws kafka describe-cluster-operation --cluster-operation-arn ClusterOperationArn

该 describe-cluster-operation 命令的输出如以下 JSON 示例所示。

{
    "ClusterOperationInfo": {
        "ClientRequestId": "c0b7af47-8591-45b5-9c0c-909a1a2c99ea",
        "ClusterArn": "arn:aws:kafka:us-east-1:012345678012:cluster/exampleClusterName/abcdefab-1234-abcd-5678-cdef0123ab01-2",
        "CreationTime": "2021-09-17T02:35:47.753000+00:00",
        "OperationArn": "arn:aws:kafka:us-east-1:012345678012:cluster-operation/exampleClusterName/abcdefab-1234-abcd-5678-cdef0123ab01-2/0123abcd-abcd-4f7f-1234-9876543210ef",
        "OperationState": "PENDING",
        "OperationType": "UPDATE_SECURITY",
        "SourceClusterInfo": {},
        "TargetClusterInfo": {}
    }
}

如果 OperationState 的值为 PENDING 或 UPDATE_IN_PROGRESS，请等待一段时间，然后再次运行 describe-cluster-operation 命令。