# KafkaSchemaRegistryAccessConfigType

The type of authentication protocol for your schema registry.

- Source: [`aws-lambda/lib/schema-registry.ts`](https://github.com/aws/aws-cdk/blob/v2.274.0/packages/aws-cdk-lib/aws-lambda/lib/schema-registry.ts#L36)
- Type last changed: v2.215.0 · 15 Sep 2025

## Example

```ts
import { ManagedKafkaEventSource, ConfluentSchemaRegistry } from 'aws-cdk-lib/aws-lambda-event-sources';
import { Secret } from 'aws-cdk-lib/aws-secretsmanager';

// Your MSK cluster arn
declare const clusterArn: string;

// The Kafka topic you want to subscribe to
const topic = 'some-cool-topic';

const secret = new Secret(this, 'Secret', { secretName: 'AmazonMSK_KafkaSecret' });

declare const myFunction: lambda.Function;
myFunction.addEventSource(new ManagedKafkaEventSource({
  clusterArn,
  topic,
  startingPosition: lambda.StartingPosition.TRIM_HORIZON,
  provisionedPollerConfig: {
    minimumPollers: 1,
    maximumPollers: 3,
  },
  schemaRegistryConfig: new ConfluentSchemaRegistry({
    schemaRegistryUri: 'https://example.com',
    eventRecordFormat: lambda.EventRecordFormat.JSON,
    authenticationType: lambda.KafkaSchemaRegistryAccessConfigType.BASIC_AUTH,
    secret: secret,
    schemaValidationConfigs: [{ attribute: lambda.KafkaSchemaValidationAttribute.KEY }],
  }),
}));
```

## Properties

- `BASIC_AUTH`: [KafkaSchemaRegistryAccessConfigType](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.KafkaSchemaRegistryAccessConfigType.html) (required) (static) — The Secrets Manager secret that stores your broker credentials.

- `CLIENT_CERTIFICATE_TLS_AUTH`: [KafkaSchemaRegistryAccessConfigType](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.KafkaSchemaRegistryAccessConfigType.html) (required) (static) — The Secrets Manager ARN of your secret key containing the certificate chain (X.509 PEM), private key (PKCS#8 PEM), and private key password (optional) used for mutual TLS authentication of your schema registry.

- `SASL_SCRAM_256_AUTH`: [KafkaSchemaRegistryAccessConfigType](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.KafkaSchemaRegistryAccessConfigType.html) (required) (static) — The Secrets Manager ARN of your secret key used for SASL SCRAM-256 authentication of your self-managed broker.

- `SASL_SCRAM_512_AUTH`: [KafkaSchemaRegistryAccessConfigType](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.KafkaSchemaRegistryAccessConfigType.html) (required) (static) — The Secrets Manager ARN of your secret key used for SASL SCRAM-512 authentication of your self-managed broker.

- `SERVER_ROOT_CA_CERTIFICATE`: [KafkaSchemaRegistryAccessConfigType](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.KafkaSchemaRegistryAccessConfigType.html) (required) (static) — The Secrets Manager ARN of your secret key containing the root CA certificate (X.509 PEM) used for TLS encryption of your schema registry.

- `type`: string (required) — The key to use in `SchemaRegistryConfig.AccessConfig.Type` property in CloudFormation.

- `VIRTUAL_HOST`: [KafkaSchemaRegistryAccessConfigType](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.KafkaSchemaRegistryAccessConfigType.html) (required) (static) — The name of the virtual host in your schema registry.

  Lambda uses this broker host as the event source.

- `VPC_SECURITY_GROUP`: [KafkaSchemaRegistryAccessConfigType](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.KafkaSchemaRegistryAccessConfigType.html) (required) (static) — The VPC security group used to manage access to your self-managed brokers.

- `VPC_SUBNET`: [KafkaSchemaRegistryAccessConfigType](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.KafkaSchemaRegistryAccessConfigType.html) (required) (static) — The subnets associated with your VPC.

  Lambda connects to these subnets to fetch data from your self-managed cluster.

## Methods

- `of(name: string): KafkaSchemaRegistryAccessConfigType // chainable` (static) — A custom source access configuration property for schema registry.