Updated on 2023-08-18 GMT+08:00

Configuring Public Access

To access a Kafka instance over a public network, enable public access and configure EIPs for the instance.

If you no longer need public access to the instance, you can disable it as required.

Prerequisites

  • You can change the public access setting only when the Kafka instance is in the Running state.
  • Only IPv4 EIPs can be bound to Kafka instances.

Enabling Public Network Access

  1. Log in to the management console.
  2. Click in the upper left corner to select a region.

    Select the region where your Kafka instance is located.

  3. Click and choose Application > Distributed Message Service (for Kafka) to open the console of DMS for Kafka.
  4. Click a Kafka instance to go to the Basic Information tab page.
  5. Click next to Public Access to enable public access. For Elastic IP Address, select an EIP for each broker and then click .

    You can view the operation progress on the Background Tasks page. If the task status is Successful, the modification has succeeded.

    Figure 1 Enabling public access

    After public access is enabled, configure security group rules listed in Table 1 before attempting to access Kafka. For details about accessing Kafka, see Accessing a Kafka Instance.

    Table 1 Security group rules (public network access)

    Direction

    Protocol

    Port

    Source

    Description

    Inbound

    TCP

    9094

    0.0.0.0/0

    Access Kafka through the public network (without SSL encryption).

    Inbound

    TCP

    9095

    0.0.0.0/0

    Access Kafka through the public network (with SSL encryption).

Disabling Public Network Access

  1. Log in to the management console.
  2. Click in the upper left corner to select a region.

    Select the region where your Kafka instance is located.

  3. Click and choose Application > Distributed Message Service (for Kafka) to open the console of DMS for Kafka.
  4. Click a Kafka instance to go to the Basic Information tab page.
  5. Click next to Public Access.

    You can view the operation progress on the Background Tasks page. If the task status is Successful, the modification has succeeded.

    After public access is disabled, configure security group rules listed in Table 2 before attempting to access Kafka in a VPC. For details about accessing Kafka, see Accessing a Kafka Instance.

    Table 2 Security group rules (private network access)

    Direction

    Protocol

    Port

    Source

    Description

    Inbound

    TCP

    9092

    0.0.0.0/0

    Access a Kafka instance within a VPC (without SSL encryption).

    Inbound

    TCP

    9093

    0.0.0.0/0

    Access a Kafka instance within a VPC (with SSL encryption).

    After a security group is created, its default inbound rule allows communication among ECSs within the security group and its default outbound rule allows all outbound traffic. In this case, you can access a Kafka instance within a VPC, and do not need to add rules according to Table 2.