General Issue

We want to use IAM auth but this is only for Java so we also need TLS for python etc.

The Question

We want to use IAM auth but this is only for Java so we also need TLS for python etc.
When i use the AWS Console to create a MSK cluster I can select none, TLS and IAM and get multiple connection string. eg:

TLS:
b-1..$$$$.kafka.us-west-2.amazonaws.com:9094,b-2..$$$$.kafka.us-west-2.amazonaws.com:9094
IAM:
b-1..$$$$.kafka.us-west-2.amazonaws.com:9098,b-2..$$$$.kafka.us-west-2.amazonaws.com:9098
Plaintext:
b-1..$$$$.kafka.us-west-2.amazonaws.com:9092,b-2..$$$$.kafka.us-west-2.amazonaws.com:9092

However the logic in the cluster.ts prevents creating a dual TLS and IAM credential properties class, and even if it did then this logic only acts on one type

let clientAuthentication;
if (props.clientAuthentication?.saslProps?.iam) {
  clientAuthentication = {
    sasl: { iam: { enabled: props.clientAuthentication.saslProps.iam } },
  };
} else if (props.clientAuthentication?.saslProps?.scram) {
  clientAuthentication = {
    sasl: {
      scram: {
        enabled: props.clientAuthentication.saslProps.scram,
      },
    },
  };
} else if (
  props.clientAuthentication?.tlsProps?.certificateAuthorities !== undefined
) {
  clientAuthentication = {
    tls: {
      certificateAuthorityArnList: props.clientAuthentication?.tlsProps?.certificateAuthorities.map(
        (ca) => ca.certificateAuthorityArn,
      ),
    },
  };
}

Is this constraint imposed by the SDK - havent had time to look there - and how does the console manage it?

CDK CLI Version

1.123.0

Framework Version

1.127.0

Node.js Version

14.17.0

OS

any

Language

Typescript

Language Version

3.9.7

Other information

No response