AWS Lambda can now authenticate to self-managed Kafka with OAuth, not only SASL and mTLS
Serguey Asael Shinder2 min readAWS announced on 9 October that AWS Lambda supports OAuth authentication for self-managed Apache Kafka event source mappings (ESM). "Self-managed" in Lambda's terms covers both clusters a customer runs itself and Kafka services operated by other vendors — the announcement names Confluent Cloud, Aiven and Redpanda. Amazon's own MSK has a separate event source type and is not what this launch is about.
What changed. An event source mapping is the piece of Lambda that polls a Kafka topic, batches records and invokes a function, with scaling, error handling and filtering handled by the service. Until now, a self-managed Kafka ESM could authenticate to the cluster only with SASL/PLAIN, SASL/SCRAM or mutual TLS. AWS says that left out customers in regulated industries whose policies require OAuth: they could not use the managed consumer at all and had to run their own. With this change the ESM can obtain tokens from an enterprise identity provider — the announcement gives Amazon Cognito and Okta as examples — and present them to the broker.
Availability and setup. The feature is available in all commercial AWS Regions where self-managed Kafka ESM is offered; GovCloud and China Regions are not mentioned. OAuth is configured when creating a new Kafka ESM, through the console, the Lambda API, the AWS CLI, CloudFormation or SAM. The announcement does not say whether an existing mapping can be switched to OAuth in place, so teams migrating should plan to create a new mapping and check how consumer group offsets carry over. For costs, the announcement points to the standard Lambda pricing page.
Why it matters. For organisations that already run Kafka behind a corporate identity provider, the authentication method was the blocker for using Lambda as a serverless consumer of payment, fraud-detection or streaming-pipeline topics — the use cases AWS itself lists. Moving from static SASL credentials to tokens also changes what has to be rotated and audited: credentials live with the identity provider rather than in a secret attached to the mapping. The exact OAuth grant types and token settings supported are documented in the Lambda developer guide rather than in the announcement.
Source: AWS What's New, 9 October 2026 — https://aws.amazon.com/about-aws/whats-new/2026/10/aws-Lambda-supports-oauth-kafka-esm/