aws-msk-alpha: Cluster enforces incorrect authentication constraint

[jkahn117]

Describe the bug

The Cluster construct in the aws-msk-alpha package currently enforces an erroneous authentication constraint on line 499-504.

The current version prevents SCRAM and IAM authentication from being configured at the same time on the cluster. This behavior is incorrect. Amazon MSK allows multiple authentication modes and cluster can be configured in the AWS Console as such (see screenshot).

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

Allow MSK cluster to be configured with both IAM and SCRAM auth at the same time.

Current Behavior

Raises an exception stating Only one client authentication method can be enabled.

Reproduction Steps

new msk.Cluster(this, 'KafkaCluster', {
      clusterName: 'test',
      kafkaVersion: msk.KafkaVersion.V3_6_0,
      vpc: props.vpc,
      securityGroups: [ props.securityGroup ],
      encryptionInTransit: {
        clientBroker: msk.ClientBrokerEncryption.TLS,
      },
      clientAuthentication: msk.ClientAuthentication.sasl({
        scram: true,
        iam: true,
      }),
    });

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.174.0 (build 9604329)

Framework Version

No response

Node.js Version

v23.5

OS

MacOs

Language

TypeScript

Language Version

No response

Other information

No response

[khushail]

@jkahn117 , Thanks for reaching out. Looks like this article and relevant support was published in Sept 2021 while the code changes were implemented before that(June,2021). There has been no updates/changes after that.

aws-cdk/packages/@aws-cdk/aws-msk-alpha/lib/cluster.ts

Line 503 in 6218f3a

throw Error('Only one client authentication method can be enabled.');

So marking it as P2, which means it won't be immediately addressed by the team but would be on their radar. Community contributions are also welcome.

Thanks.

[mazyu36]

PR has already submitted #31743.