Amazon MSK failed to associate 1 secret for cluster. The provided secret has an invalid schema

Question

We want to set up Username and password authentication with AWS Secrets Manager as per the documentation.

We created a cluster in MSK
Created a secret as well with name AmazonMSK_testmsk2 and with key as Password and Value as { "username": "alice", "password": "alice-secret" }

Still when we associate the secret with MSK we get the error Amazon MSK failed to associate 1 secret for cluster. The provided secret has an invalid schema

The troubleshooting documentation is not of much help either

score 3 · Answer 1 · answered May 17 '22 at 18:57

3

This error can occur when one or more pre-requisites for creating the secret has not been followed. There are a few pre-requisites when creating the secret. AWS document for reference. Listing them below for quick access.

Choose Other type of secrets (e.g. API key) for the secret type.
Your secret name must have the prefix AmazonMSK_
Your user and password data must be in the following format to enter key-value pairs using the Plaintext option.

    {
      "username": "alice",
      "password": "alice-secret"
    }

answered May 17 '22 at 18:57

Sourabh Mokhasi

109
8

I followed those steps, but still getting error mention above. :( – la_femme_it Oct 18 '22 at 09:45
Even though key value option looks the same, apparently, it has to be created via plaintext option – krsoni Mar 13 '23 at 11:38

score 2 · Answer 2 · answered Apr 18 '22 at 13:48

2

Turns out you need to use Plaintext form.

answered Apr 18 '22 at 13:48

codeaprendiz

2,703
1
25
49

score 1 · Answer 3 · answered Nov 14 '22 at 10:03

In addition to @Sourabh 's answer, a secret created with the default AWS KMS key cannot be used with an Amazon MSK cluster,

so what you need to do is:

Open the Secrets Manager console.
In Secret name, choose your secret.
Choose Actions, and then choose dropdown list, select the AWS KMS key, select the check box for Create new version of secret with new encryption key, and then choose Save.

that should solve this error

Amazon MSK failed to associate 1 secret for cluster sasl-cluster. Wait for a few minutes and try again. If the problem persists, see AWS Support Center . API Response : The provided secret is encrypted with the default key. You can't use this secret with Amazon MSK.

score 1 · Answer 4 · answered Nov 23 '22 at 08:22

1

This is happening because at the time of secret creation you had selected the default aws kms option. Frist you have to create the new KMS then you have to update it in secret manager creation time.

After following all you will not get this error.

answered Nov 23 '22 at 08:22

Shrikant Verma

35
3

score 0 · Answer 5 · answered May 12 '23 at 22:50

0

You can't use a backslash in the password:

will give this error:

You can save it, but you cannot associate it with a cluster.

answered May 12 '23 at 22:50

Ri4a

640
7
13

Amazon MSK failed to associate 1 secret for cluster. The provided secret has an invalid schema

5 Answers5