C++ AWS MSK IAM Auth Implementation – Goodbye Kafka Passwords
In 2023, AWS announced[1] IAM authentication for MSK Kafka clusters with support for "all programming languages"… except C++. While Java[2], Python[3], Go[4], and others got official SDKs, C++ developers/vendors were stuck hardcoding SCRAM-SHA credentials in code/configs or relying on heavier Java-based tools like Kafka Connect or Apache Flink. Later, community projects added Rust[5] and Ruby[6] support. Why no C++? Rust might be the new favorite, but C++ is still king for high-performance data systems: minimal dependencies, lean resource use, and raw speed. At Timeplus, we needed…
In plain words
This is a C++ implementation that enables AWS IAM authentication for MSK Kafka clusters, eliminating the need to hardcode credentials. Built by Timeplus for their Proton streaming engine, it works by attaching an IAM role to EC2 instances or EKS pods. The implementation addresses a gap left by AWS, which provided official SDKs for Java, Python, and Go but not C++. Designed for developers and vendors building high-performance data systems in C++, it offers minimal dependencies and efficient resource usage while simplifying secure cluster access.
written from the facts on this page · September 2026
From the sources
In the maker’s words, at launch
In 2023, AWS announced[1] IAM authentication for MSK Kafka clusters with support for "all programming languages"… except C++. While Java[2], Python[3], Go[4], and others got official SDKs, C++ developers/vendors were stuck hardcoding SCRAM-SHA credentials in code/configs or relying on heavier Java-based tools like Kafka Connect or Apache Flink. Later, community projects added Rust[5] and Ruby[6] support. Why no C++? Rust might be the new favorite, but C++ is still king for high-performance data systems: minimal dependencies, lean resource use, and raw speed. At Timeplus, we needed IAM auth for our C++ streaming engine, Proton, so we built it ourselves. Today, we’re open-sourcing our code for AWS MSK IAM authentication. It’s live in Timeplus Proton 1.6.12 Just attach an IAM role to your EC2 instance or EKS pod, then put the Timeplus Proton single binary inside, start the server, then run the following SQL to read or write MSK: CREATE EXTERNAL STREAM msk_stream(column_defs) SETTINGS type='kafka',topic='topic2', brokers='prefix.kafka.us-west-2.amazonaws.com:9098', security_protocol='SASL_SSL', sasl_mechanism='AWS_MSK_IAM'; The core logic is just two files under 200 lines and you can reuse the code anywhere. https://github.com/timeplus-io/proton/blob/develop/src/IO/Ka... https://github.com/timeplus-io/proton/blob/develop/src/IO/Ka... We’d love to get your feedback and work together to make this a standalone library—or even get it into ClickHouse or AWS SDK for C++. For those curious about Timeplus Proton: it’s an open-source streaming engine we built in C++ (think “FlinkSQL in C++” meets ClickHouse’s columnar storage). Later this month, we will also open-source our C++ code for Apache Iceberg read&write. Stay tuned. Links: [1] https://aws.amazon.com/blogs/big-data/amazon-msk-iam-authent... [2] https://github.com/aws/aws-msk-iam-auth [3] https://github.com/aws/aws-msk-iam-sasl-signer-python [4] https://github.com/aws/aws-msk-iam-sasl-signer-go [5] https://docs.rs/aws-msk-iam-sasl-signer [6] https://rubygems.org/gems/aws-msk-iam-sasl-signer/
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, March 2025
the whole month →
Mimic Human Research & Save Findings in AI Knowledge Base
AI · 2025 · sider.ai
