View a markdown version of this page

IAM and access control - Amazon Managed Streaming for Apache Kafka

IAM and access control

A Channel uses IAM roles for authorization. Follow least privilege:

  • Scope S3 Tables permissions to the specific bucket used by the Channel.

  • Scope Glue Schema Registry permissions to the specific registry used by the Channel.

  • Use aws:SourceArn and aws:SourceAccount in the trust policy to prevent confused deputy attacks.