Amazon MSK Replicator expanded its authentication options by introducing mutual TLS (mTLS) for linking external Apache Kafka clusters—including on-premises and other cloud deployments—to MSK Express brokers on AWS. This enables secure migration, disaster recovery setups, and hybrid or multi-cloud data distribution with encrypted connections.
Prior versions only supported SASL/SCRAM for external clusters. MSK Replicator provides managed replication retaining original Kafka topic names, prevents infinite replication loops, and synchronizes consumer offsets bidirectionally. This update is available across all AWS regions supporting MSK Express. Independent benchmarks on performance and security impacts were not detailed in the source.
Source & further reading
MSK Replicator now supports mutual TLS (mTLS) authentication for replication from external Apache Kafka clusters to MSK Express brokers ↗Source published 2026-06-22. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.