Preparing Required Resources

Overview

Before creating a Kafka instance, ensure the availability of resources, including a virtual private cloud (VPC), subnet, security group, and security group rules. Each Kafka instance is deployed in a VPC and bound to a specific subnet and security group. In this way, Kafka provides an isolated virtual network environment and security protection policies that you can easily configure and manage.

To access a Kafka instance over a public network, prepare an elastic IP address (EIP) in advance.

To encrypt the disk, prepare a KMS key in advance.

Required Resources

Table 1 lists the resources required by a Kafka instance.

Table 1 Kafka resources

Resource

Requirement

Operations

VPC and subnet

Different Kafka instances can use the same or different VPCs and subnets based on site requirements. Note the following when creating a VPC and a subnet:

  • The VPC must be created in the same region as the Kafka instance.

  • Use the default settings when creating a VPC and subnet.

For details about how to create a VPC and subnet, see the Virtual Private Cloud User Guide.

Security group

Different Kafka instances can use the same or different security groups. Note the following when creating a security group:

  • To use Kafka instances, add the security group rules described in Table 2. Other rules can be added based on site requirements.

    Note

    After a security group is created, its default inbound rule allows communication among ECSs within the security group and its default outbound rule allows all outbound traffic. In this case, you can access a Kafka instance within a VPC, and do not need to add rules according to Table 2.

For details about how to create a security group and configure security group rules, see the Virtual Private Cloud User Guide.

EIP

Note the following when creating EIPs:

  • The EIPs must be created in the same region as the Kafka instance.

  • The number of EIPs must be the same as the number of Kafka instance brokers.

For details about how to create an EIP, see "Assigning an EIP" in Elastic IP User Guide.

KMS key

To encrypt the disk for a Kafka instance, prepare a KMS key in advance.

The KMS key must be created in the same region as the Kafka instance.

For details about how to create a KMS key, see "Creating a Key" in the Key Management Service User Guide.

Table 2 Security group rules

Direction

Protocol

Port

Source

Description

Inbound

TCP

9094

0.0.0.0/0

Access a Kafka instance through the public network (without SSL encryption).

Inbound

TCP

9092

0.0.0.0/0

Access a Kafka instance within a VPC (without SSL encryption).

Inbound

TCP

9095

0.0.0.0/0

Access a Kafka instance through the public network (with SSL encryption).

Inbound

TCP

9093

0.0.0.0/0

Access a Kafka instance within a VPC (with SSL encryption).

Inbound

TCP

9011

198.19.128.0/17

Access a Kafka instance using VPC Endpoint (VPCEP).

Inbound

TCP

9011

0.0.0.0/0

Access a Kafka instance using DNAT.

last updated: 2024-07-04 00:29