AWS Lambda supports OAuth authentication for self-managed Apache Kafka event sources

AWS Lambda has introduced OAuth authentication for self-managed Apache Kafka event source mappings (ESM), including clusters operated by customers and third-party providers like Confluent Cloud, Aiven, and Redpanda. This update enables Lambda Kafka consumers to authenticate through enterprise identity providers, addressing security and compliance needs for Kafka applications. Previously, Kafka ESM supported only SASL/PLAIN, SASL/SCRAM, and mutual TLS, limiting options for industries requiring OAuth-based authentication.

Customers using Kafka ESM for event-driven workloads such as payment processing, fraud detection, and real-time data pipelines benefit from features like automatic scaling, error handling, batching, and event filtering. The addition of OAuth authentication allows these users to integrate their enterprise identity providers, such as Amazon Cognito or Okta, to manage access policies consistently across Kafka clusters and Lambda consumers.

The new OAuth support is available in all AWS commercial Regions where self-managed Kafka ESM is supported. To implement this, users can configure authentication through the AWS Management Console, Lambda API, AWS CLI, AWS CloudFormation, or AWS SAM when creating a new Kafka ESM. This integration simplifies the process of meeting regulatory requirements while maintaining operational efficiency.

AWS Lambda pricing remains unchanged, and users can refer to the AWS Lambda developer guide for detailed instructions on configuring OAuth authentication for Kafka ESM. The update expands authentication flexibility without altering existing pricing or core functionality.