Kafka TLS Certificates from a Customer's AWS Secrets Manager

Last updated: September 8, 2026

Context

Customers can now store their Kafka TLS certificates in their own AWS Secrets Manager. During deployment, we retrieve the certificate directly from their secret, removing the need for manual certificate handovers during rotation.

💡 Opt-in: If AWS Secrets Manager is not configured, the existing Vault-based certificate flow remains unchanged.

Customer Requirements

1. AWS Secret

The secret must contain:

{
  "cert": "<base64 PEM>",
  "key": "<base64 PEM>",
  "ca": "<base64 PEM>"
}

  • cert and key are required.

  • ca is required either in the secret or already stored in Vault for the workspace.

  • Values must be PEM certificates/keys encoded as Base64.

2. Secret ARN

Provide the full Secrets Manager ARN:

arn:aws:secretsmanager:eu-west-1:123456789012:secret:name-AbCdEf

3. AWS Permissions

The customer's AWS account must allow our deployment role:

secretsmanager:GetSecretValue
kms:Decrypt

Both permissions are required.

4. AWS Region

The secret must be in the same AWS region as the pipeline.

Configuration

  1. Ensure the workspace migration has been applied.

  2. If the CA is not in the secret, add it to Vault for the workspace.

  3. Set the Consul key:

config/target/kafka_tls_secret_arn

to the customer's secret ARN.

Leave it blank to continue using Vault.

  1. Run the usual plan/apply for aws_snowbridge.

  2. Verify Snowbridge starts successfully and connects to Kafka over TLS.

The deployment validates the secret and reports errors such as invalid ARN, wrong region, missing permissions, or missing certificate/key.

🔄 Certificate Rotation

Once configured, customers can rotate the certificate directly in AWS Secrets Manager. The updated certificate will be picked up during the next aws_snowbridge deployment.

🆘 Need Help?

For any questions or support, reach out to the SRE team.