Secure Public Access

Use CaseSecurityZilla Plus

★Zilla Plus This use case is implemented by Zilla Plus, Aklivity's commercial edition of Kafka Gateway.

The Problem

Kafka clients outside your cloud account or VPC (partners, remote services, other business units) need to connect, publish, and subscribe to topics in your Kafka cluster, but the cluster is private by design. Exposing brokers directly to the internet means terminating TLS, running an authentication layer, and managing DNS for every broker yourself, all without changing how the cluster is provisioned.

How Zilla Solves It

Zilla Plus automates an internet-facing network load balancer and an auto-scaling fleet of stateless Secure Public Access proxies in front of your Kafka cluster. External clients connect over a wildcard DNS pattern that resolves to the proxy fleet, terminate TLS there, and authenticate with IAM, SASL/SCRAM, or mutual TLS, all with no configuration changes to the Kafka cluster itself.

Architecture

Key Features

No modifications to the Kafka cluster are required to enable a custom bootstrap domain over the internet.
Custom wildcard DNS resolving to the proxy fleet.
End-to-end TLS handshake between client and proxy.
IAM, SASL, and mTLS authentication, integrated with AWS Secrets Manager and AWS Certificate Manager.
Auto-scaling proxy instances deployed behind a network load balancer for high availability.
Integrates with AWS Nitro Enclaves for automated certificate renewal.

Authentication Options

Zilla Plus for Amazon MSK supports several authentication modes for public access, selectable at deploy time via the CDK or Terraform templates:

IAM: clients authenticate using AWS IAM credentials.
SASL/SCRAM: clients authenticate with a username and password stored in AWS Secrets Manager.
Mutual TLS (mTLS): clients authenticate with a client certificate signed by a certificate authority you control.
Unauthorized access: no client authentication, intended for development and testing only.

The CloudFormation walkthroughs below cover SASL/SCRAM, mTLS, and unauthorized access in full step-by-step detail; IAM access control is available through the CDK and Terraform templates.

Deploy

Amazon MSK

Secure Public Access with CDK: generate or deploy a custom AWS CDK stack with IAM, SASL/SCRAM, mTLS, or unauthorized access.
Secure Public Access with Terraform: deploy the same options using a CDKTF Terraform template.
Step-by-step CloudFormation walkthroughs, each using a globally or locally trusted TLS certificate for the wildcard DNS pattern *.example.aklivity.io:

Confluent Cloud

Secure Public Access with CDK: generate or deploy a custom CDK stack.
Secure Public Access via CloudFormation: step-by-step walkthrough using a globally trusted TLS certificate.