Unable to define multiple option in MSK client authentification

[QualoZe0t]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform CLI and Terraform AWS Provider Version

Terraform v1.0.0
on darwin_amd64

• provider registry.terraform.io/hashicorp/aws v3.60.0
• provider registry.terraform.io/hashicorp/random v3.1.0

Your version of Terraform is out of date! The latest version
is 1.0.8. You can update by downloading from https://www.terraform.io/downloads.html
(⎈ |487847171572:cluster/iptiq-eks_nonprod_cluster:default)➜ msk-test-settings git:(SII-1412) ✗

Affected Resource(s)

• aws_XXXXX

Terraform Configuration Files

Please include all Terraform configurations required to reproduce the bug. Bug reports without a functional reproduction may be closed without investigation.

resource "aws_msk_cluster" "kafka" {
  cluster_name = local.cluster_name
  kafka_version          = var.cluster_version
  number_of_broker_nodes = length(data.aws_availability_zones.available.names)

  broker_node_group_info {
    instance_type   = var.broker_node_instance_type
    ebs_volume_size = var.broker_node_ebs_size
    client_subnets  = var.database_subnets
    security_groups = [aws_security_group.kafka-sg.id]
  }
  client_authentication {  
    sasl {
      scram = true
    }
    tls {
      certificate_authority_arns = [var.kafka_ca_arn]
      }
  }

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key: https://keybase.io/hashicorp

Debug Output

╷
│ Error: Conflicting configuration arguments
│
│ with aws_msk_cluster.kafka,
│ on cluster.tf line 14, in resource "aws_msk_cluster" "kafka":
│ 14: sasl {
│
│ "client_authentication.0.sasl": conflicts with client_authentication.0.tls
╵
ERRO[0031] 1 error occurred:
* exit status 1

Panic Output

Expected Behavior

Well I would like to enable authentification TLS and SASL scram as is possible to define via api or aws console

Actual Behavior

I am not able to define multiple client authentification SASL + TLS,..

I have kafka deployed where is enabled plaintext + tls .. now i would like to have also SASL (9096) .. after implementation will delete plaintext.
I would like to ask is it possible to define in terraform multiple client_authentification ?

Steps to Reproduce

1. terraform apply

Important Factoids

References

• #0000

[ewbankkit]

@QualoZe0t Thanks for raising this issue.
It has already been noticed in #20956. I'm going to close this one as a duplicate so that we can concentrate discussion in the linked issue.
Please add any additional comments there.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.