Apache Pinot

Hey,

I need to connect AWS MSK with pinot(AWS EKS) using IAM Auth. Are there steps documented for this? This seems to be a common use-case.

<https://docs.pinot.apache.org/operators/tutorials/how-to-connect-pinot-with-amazon-managed-streaming-for-apache-kafka-amazon-msk|https://docs.pinot.apache.org/operators/tutorials/how-to-connect-pinot-with-amazon-managed-streaming-for-apache-kafka-amazon-msk>

<https://docs.pinot.apache.org/basics/getting-started/public-cloud-examples/aws-quickstart#id-2.-optional-log-in-to-your-aws-account|https://docs.pinot.apache.org/basics/getting-started/public-cloud-examples/aws-quickstart#id-2.-optional-log-in-to-your-aws-account>

We should probably consolidate IAM support <@U011R2VMS4S> 

Thanks for the doc Mayank! I need the doc for setting up pinot connection with AWS MSK using IAM as auth mechanism. In the above docs only plaintext communication has been enabled.

My bad, try this
```Add the following to table config
        "security.protocol": "SASL_SSL",
        "sasl.mechanism": "AWS_MSK_IAM",
        "sasl.jaas.config": "software.amazon.msk.auth.iam.IAMLoginModule required awsRoleArn=\"YOUR_ROLE_HERE\";",
        "sasl.client.callback.handler.class": "software.amazon.msk.auth.iam.IAMClientCallbackHandler"
Replace YOUR_ROLE_HERE with the attached AWS role to your pods

Ensure that EC2 role should have AmazonMSKFullAccess and AWSMSKReplicatorExecutionRole permissions (in some cases sts-full-access might also be needed).

The Role's trust relationship in AWS should also allow the following principle
"AWS": "arn:aws:sts::{ACCOUNT_ID}:assumed-role/{ROLE_NAME}/{ROLE_SESSION_NAME}"

Generally the ROLE_SESSION_NAME corresponds to the instance id. In that case, you will need to put all the instanceIDs in the principle
OR
you can simply do "AWS": "*"```

Thanks for sharing this. Are there any steps to add support for aws-msk-iam-auth lib in Pinot? Or is it supported by default?

Hi <@U011R2VMS4S> - I tried the suggestion you posted but getting error, failed to construct kafka consumer