| Name | Version |
|---|---|
| terraform | >= 1.0.0 |
| aws | >= 4.0 |
No providers.
| Name | Source | Version |
|---|---|---|
| kafka | cloudposse/msk-apache-kafka-cluster/aws | 2.4.0 |
No resources.
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| additional_security_group_rules | A list of Security Group rule objects to add to the created security group, in addition to the ones this module normally creates. (To suppress the module's rules, set create_security_group to falseand supply your own security group(s) via associated_security_group_ids.)The keys and values of the objects are fully compatible with the aws_security_group_rule resource, exceptfor security_group_id which will be ignored, and the optional "key" which, if provided, must be unique and known at "plan" time.For more info see https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule and https://github.com/cloudposse/terraform-aws-security-group. |
list(any) |
[] |
no |
| allow_all_egress | If true, the created security group will allow egress on all ports and protocols to all IP addresses.If this is false and no egress rules are otherwise specified, then no egress will be allowed. |
bool |
true |
no |
| allowed_cidr_blocks | A list of IPv4 CIDRs to allow access to the security group created by this module. The length of this list must be known at "plan" time. |
list(string) |
[] |
no |
| allowed_security_group_ids | A list of IDs of Security Groups to allow access to the security group created by this module. The length of this list must be known at "plan" time. |
list(string) |
[] |
no |
| associated_security_group_ids | A list of IDs of Security Groups to associate the created resource with, in addition to the created security group. These security groups will not be modified and, if create_security_group is false, must have rules providing the desired access. |
list(string) |
[] |
no |
| autoscaling_enabled | To automatically expand your cluster's storage in response to increased usage, you can enable this. More info | bool |
true |
no |
| broker_dns_records_count | This variable specifies how many DNS records to create for the broker endpoints in the DNS zone provided in the zone_id variable.This corresponds to the total number of broker endpoints created by the module. Calculate this number by multiplying the broker_per_zone variable by the subnet count.This variable is necessary to prevent the Terraform error: The "count" value depends on resource attributes that cannot be determined until apply, so Terraform cannot predict how many instances will be created. |
number |
0 |
no |
| broker_instance_type | Specify the instance type to use for the kafka brokers | string |
n/a | yes |
| broker_per_zone | Number of Kafka brokers per zone | number |
1 |
no |
| broker_volume_size | The size in GiB of the EBS volume for the data drive on each broker node | number |
1000 |
no |
| certificate_authority_arns | List of ACM Certificate Authority Amazon Resource Names (ARNs) to be used for TLS client authentication | list(string) |
[] |
no |
| client_allow_unauthenticated | Enable unauthenticated access | bool |
false |
no |
| client_broker | Encryption setting for data in transit between clients and brokers. Valid values: TLS, TLS_PLAINTEXT, and PLAINTEXT |
string |
"TLS" |
no |
| client_sasl_iam_enabled | Enable client authentication via IAM policies. Cannot be set to true at the same time as client_tls_auth_enabled |
bool |
false |
no |
| client_sasl_scram_enabled | Enable SCRAM client authentication via AWS Secrets Manager. Cannot be set to true at the same time as client_tls_auth_enabled |
bool |
false |
no |
| client_sasl_scram_secret_association_arns | List of AWS Secrets Manager secret ARNs for SCRAM authentication | list(string) |
[] |
no |
| client_sasl_scram_secret_association_enabled | Enable the list of AWS Secrets Manager secret ARNs for SCRAM authentication | bool |
true |
no |
| client_tls_auth_enabled | Set true to enable the Client TLS Authentication |
bool |
false |
no |
| cloudwatch_logs_enabled | Indicates whether you want to enable or disable streaming broker logs to Cloudwatch Logs | bool |
false |
no |
| cloudwatch_logs_log_group | Name of the Cloudwatch Log Group to deliver logs to | string |
null |
no |
| create_security_group | Set true to create and configure a new security group. If false, associated_security_group_ids must be provided. |
bool |
true |
no |
| custom_broker_dns_name | Custom Route53 DNS hostname for MSK brokers. Use %%ID%% key to specify brokers index in the hostname. Example: kafka-broker%%ID%%.example.com |
string |
null |
no |
| encryption_at_rest_kms_key_arn | You may specify a KMS key short ID or ARN (it will always output an ARN) to use for encrypting your data at rest | string |
"" |
no |
| encryption_in_cluster | Whether data communication among broker nodes is encrypted | bool |
true |
no |
| enhanced_monitoring | Specify the desired enhanced MSK CloudWatch monitoring level. Valid values: DEFAULT, PER_BROKER, and PER_TOPIC_PER_BROKER |
string |
"DEFAULT" |
no |
| firehose_delivery_stream | Name of the Kinesis Data Firehose delivery stream to deliver logs to | string |
"" |
no |
| firehose_logs_enabled | Indicates whether you want to enable or disable streaming broker logs to Kinesis Data Firehose | bool |
false |
no |
| inline_rules_enabled | NOT RECOMMENDED. Create rules "inline" instead of as separate aws_security_group_rule resources.See #20046 for one of several issues with inline rules. See this post for details on the difference between inline rules and rule resources. |
bool |
false |
no |
| jmx_exporter_enabled | Set true to enable the JMX Exporter |
bool |
false |
no |
| kafka_version | The desired Kafka software version. Refer to https://docs.aws.amazon.com/msk/latest/developerguide/supported-kafka-versions.html for more details |
string |
n/a | yes |
| name | Name for the resources | string |
n/a | yes |
| node_exporter_enabled | Set true to enable the Node Exporter |
bool |
false |
no |
| preserve_security_group_id | When false and security_group_create_before_destroy is true, changes to security group rulescause a new security group to be created with the new rules, and the existing security group is then replaced with the new one, eliminating any service interruption. When true or when changing the value (from false to true or from true to false),existing security group rules will be deleted before new ones are created, resulting in a service interruption, but preserving the security group itself. NOTE: Setting this to true does not guarantee the security group will never be replaced,it only keeps changes to the security group rules from triggering a replacement. See the terraform-aws-security-group README for further discussion. |
bool |
false |
no |
| private_subnets | List of private subnets in the VPC | list(string) |
n/a | yes |
| properties | Contents of the server.properties file. Supported properties are documented in the MSK Developer Guide | map(string) |
{} |
no |
| public_access_enabled | Enable public access to MSK cluster (given that all of the requirements are met) | bool |
false |
no |
| region | AWS region | string |
n/a | yes |
| s3_logs_bucket | Name of the S3 bucket to deliver logs to | string |
"" |
no |
| s3_logs_enabled | Indicates whether you want to enable or disable streaming broker logs to S3 | bool |
false |
no |
| s3_logs_prefix | Prefix to append to the S3 folder name logs are delivered to | string |
"" |
no |
| security_group_create_before_destroy | Set true to enable terraform create_before_destroy behavior on the created security group.We only recommend setting this false if you are importing an existing security groupthat you do not want replaced and therefore need full control over its name. Note that changing this value will always cause the security group to be replaced. |
bool |
true |
no |
| security_group_create_timeout | How long to wait for the security group to be created. | string |
"10m" |
no |
| security_group_delete_timeout | How long to retry on DependencyViolation errors during security group deletion fromlingering ENIs left by certain AWS services such as Elastic Load Balancing. |
string |
"15m" |
no |
| security_group_description | The description to assign to the created Security Group. Warning: Changing the description causes the security group to be replaced. |
string |
"Managed by Terraform" |
no |
| security_group_name | The name to assign to the created security group. Must be unique within the VPC. If not provided, will be derived from the null-label.context passed in.If create_before_destroy is true, will be used as a name prefix. |
list(string) |
[] |
no |
| security_group_rule_description | The description to place on each security group rule. | string |
"Allow inbound %s traffic" |
no |
| storage_autoscaling_disable_scale_in | If the value is true, scale in is disabled and the target tracking policy won't remove capacity from the scalable resource | bool |
false |
no |
| storage_autoscaling_max_capacity | Maximum size the autoscaling policy can scale storage. Defaults to broker_volume_size |
number |
null |
no |
| storage_autoscaling_target_value | Percentage of storage used to trigger autoscaled storage increase | number |
60 |
no |
| tags | Additional tags for the resources | map(string) |
{} |
no |
| vpc_id | The ID of the VPC where the EKS cluster will be created | string |
n/a | yes |
| zone_id | Route53 DNS Zone ID for MSK broker hostnames | string |
null |
no |
| Name | Description |
|---|---|
| bootstrap_brokers | Comma separated list of one or more hostname:port pairs of Kafka brokers suitable to bootstrap connectivity to the Kafka cluster |
| bootstrap_brokers_public_sasl_iam | Comma separated list of one or more DNS names (or IP addresses) and SASL IAM port pairs for public access to the Kafka cluster using SASL/IAM |
| bootstrap_brokers_public_sasl_scram | Comma separated list of one or more DNS names (or IP addresses) and SASL SCRAM port pairs for public access to the Kafka cluster using SASL/SCRAM |
| bootstrap_brokers_public_tls | Comma separated list of one or more DNS names (or IP addresses) and TLS port pairs for public access to the Kafka cluster using TLS |
| bootstrap_brokers_sasl_iam | Comma separated list of one or more DNS names (or IP addresses) and SASL IAM port pairs for access to the Kafka cluster using SASL/IAM |
| bootstrap_brokers_sasl_scram | Comma separated list of one or more DNS names (or IP addresses) and SASL SCRAM port pairs for access to the Kafka cluster using SASL/SCRAM |
| bootstrap_brokers_tls | Comma separated list of one or more DNS names (or IP addresses) and TLS port pairs for access to the Kafka cluster using TLS |
| broker_endpoints | List of broker endpoints |
| cluster_arn | Amazon Resource Name (ARN) of the MSK cluster |
| cluster_name | The cluster name of the MSK cluster |
| config_arn | Amazon Resource Name (ARN) of the MSK configuration |
| current_version | Current version of the MSK Cluster |
| hostnames | List of MSK Cluster broker DNS hostnames |
| latest_revision | Latest revision of the MSK configuration |
| security_group_arn | The ARN of the created security group |
| security_group_id | The ID of the security group rule for the MSK cluster |
| security_group_name | The name of the security group rule for the MSK cluster |
| storage_mode | Storage mode for supported storage tiers |
| zookeeper_connect_string | Comma separated list of one or more hostname:port pairs to connect to the Apache Zookeeper cluster |
| zookeeper_connect_string_tls | Comma separated list of one or more hostname:port pairs to connect to the Apache Zookeeper cluster via TLS |