> **Experimental**
>
> `@aws-cdk/aws-msk-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# SaslAuthProps

SASL authentication properties.

- Stability: [Experimental](/cdk/api/stability.html)
- Source: [`lib/cluster.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0-alpha.0/packages/@aws-cdk/aws-msk-alpha/lib/cluster.ts#L386)

## Example

```ts
declare const vpc: ec2.Vpc;
const cluster = new msk.Cluster(this, 'cluster', {
  clusterName: 'myCluster',
  kafkaVersion: msk.KafkaVersion.V4_1_X_KRAFT,
  vpc,
  encryptionInTransit: {
    clientBroker: msk.ClientBrokerEncryption.TLS,
  },
  clientAuthentication: msk.ClientAuthentication.sasl({
    scram: true,
  }),
});
```

## Properties

- `iam`: boolean = false — Enable IAM access control.

- `key`: [IKeyRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_kms.IKeyRef.html) — KMS Key to encrypt SASL/SCRAM secrets.

  **Default:** CMK will be created with alias msk/{clusterName}/sasl/scram

  You must use a customer master key (CMK) when creating users in secrets manager.
  You cannot use a Secret with Amazon MSK that uses the default Secrets Manager encryption key.

- `scram`: boolean = false — Enable SASL/SCRAM authentication.