Configuring Kafka Public Access

Prerequisites

• You can change the public access setting only when the Kafka instance is in the Running state.

Notes and Constraints

Kafka instances only support IPv4 EIPs. IPv6 EIPs are not supported.

Enabling Public IPv4 Access

1. Log in to the console.
2. Click in the upper left corner to select a region.
   

   Select the region where your Kafka instance is located.

3. Click and choose Application > Distributed Message Service (for Kafka) to open the console of DMS for Kafka.
4. Click a Kafka instance to go to the Basic Information page.
5. Click next to Public Access to enable public access. For Elastic IP Address, select an EIP for each broker.

   If the EIPs are insufficient, do as follows to set them.

   1. Click Create Elastic IP to go to the Buy EIP page and purchase EIPs. For details, see Assigning an EIP.
   2. After the purchase is complete, return to the public access enabling page.
   3. Click after Elastic IP Address, select an EIP for each broker and then click .
   4. You can view the operation progress on the Background Tasks page. If the task status is Successful, the modification has succeeded.
   Figure 1 Enabling public access
   

   After public access is enabled, configure security group rules listed in Table 1 before attempting to access Kafka. For details about accessing Kafka, see Connecting to an Instance.

   Table 1 Kafka instance security group rules (public IPv4 access)

   Direction	Protocol	Type	Port	Source	Description
   Inbound	TCP	IPv4	9094	IP address or IP address group of the Kafka client	Accessing Kafka over a public network (without SSL)
   Inbound	TCP	IPv4	9095	IP address or IP address group of the Kafka client	Accessing Kafka over a public network (with SSL)

Disabling Public IPv4 Access

1. Log in to the console.
2. Click in the upper left corner to select a region.
   

   Select the region where your Kafka instance is located.

3. Click and choose Application > Distributed Message Service (for Kafka) to open the console of DMS for Kafka.
4. Click a Kafka instance to go to the Basic Information page.
5. Click next to Public Access.

   You can view the operation progress on the Background Tasks page. If the task status is Successful, the modification has succeeded.

   After public access is disabled, configure security group rules listed in Table 2 before attempting to access Kafka in a VPC. For details about accessing Kafka, see Connecting to an Instance.

   Table 2 Kafka instance security group rules (private access)

   Direction	Protocol	Type	Port	Source	Description
   Inbound	TCP	IPv4	9092	IP address or IP address group of the Kafka client	Accessing a Kafka instance over a private network within a VPC (without SSL)
   Inbound	TCP	IPv4	9093	IP address or IP address group of the Kafka client	Accessing a Kafka instance over a private network within a VPC (with SSL)

   

   After a security group is created, its default inbound rule allows communication among ECSs within the security group and its default outbound rule allows all outbound traffic. In this case, you can access a Kafka instance within a VPC, and do not need to add rules according to Table 2.