feat(aws-msk-apache-kafka-cluster-master): extra SCRAM secret ARNs and sensitive password output

modules/aws-msk-apache-kafka-cluster-master/README.md

@@ -162,6 +162,7 @@ module "kafka" {
 | <a name="input_encryption_in_cluster"></a> [encryption\_in\_cluster](#input\_encryption\_in\_cluster) | Whether data communication among broker nodes is encrypted | `bool` | `true` | no |
 | <a name="input_enhanced_monitoring"></a> [enhanced\_monitoring](#input\_enhanced\_monitoring) | Specify the desired enhanced MSK CloudWatch monitoring level. Valid values: `DEFAULT`, `PER_BROKER`, and `PER_TOPIC_PER_BROKER` | `string` | `"DEFAULT"` | no |
 | <a name="input_environment"></a> [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
+| <a name="input_extra_scram_secret_arns"></a> [extra\_scram\_secret\_arns](#input\_extra\_scram\_secret\_arns) | Additional AWS Secrets Manager secret ARNs of per-user SCRAM credentials to associate with the cluster alongside the module-managed secret. The secrets and their values are managed out-of-band; pass ARNs only. MSK rejects secrets encrypted with the Secrets Manager default key, so each secret must use the cluster's KMS key (`encryption_at_rest_kms_key_arn`). | `list(string)` | `[]` | no |
 | <a name="input_firehose_delivery_stream"></a> [firehose\_delivery\_stream](#input\_firehose\_delivery\_stream) | Name of the Kinesis Data Firehose delivery stream to deliver logs to | `string` | `""` | no |
 | <a name="input_firehose_logs_enabled"></a> [firehose\_logs\_enabled](#input\_firehose\_logs\_enabled) | Indicates whether you want to enable or disable streaming broker logs to Kinesis Data Firehose | `bool` | `false` | no |
 | <a name="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for keep the existing setting, which defaults to `0`.<br>Does not affect `id_full`. | `number` | `null` | no |
@@ -211,6 +212,7 @@ module "kafka" {
 | <a name="output_current_version"></a> [current\_version](#output\_current\_version) | Current version of the MSK Cluster used for updates |
 | <a name="output_hostname"></a> [hostname](#output\_hostname) | Comma separated list of one or more MSK Cluster Broker DNS hostname |
 | <a name="output_latest_revision"></a> [latest\_revision](#output\_latest\_revision) | Latest revision of the configuration |
+| <a name="output_password"></a> [password](#output\_password) | Generated SCRAM password of the module-managed user. Marked `sensitive`, so it is redacted in plan and apply output; a caller that re-exports it must mark its own output `sensitive` too. |
 | <a name="output_security_group_id"></a> [security\_group\_id](#output\_security\_group\_id) | The ID of the security group rule |
 | <a name="output_security_group_name"></a> [security\_group\_name](#output\_security\_group\_name) | The name of the security group rule |
 | <a name="output_zookeeper_connect_string"></a> [zookeeper\_connect\_string](#output\_zookeeper\_connect\_string) | A comma separated list of one or more hostname:port pairs to use to connect to the Apache Zookeeper cluster |

modules/aws-msk-apache-kafka-cluster-master/main.tf

@@ -240,11 +240,12 @@ resource "aws_msk_cluster" "default" {
   tags = var.tags
 }
 
+# Extra ARNs come from per-user SCRAM secrets managed out-of-band; listing them here stops apply from disassociating them
 resource "aws_msk_scram_secret_association" "default" {
   count = local.enabled && var.client_sasl_scram_enabled ? 1 : 0
 
   cluster_arn     = aws_msk_cluster.default[0].arn
-  secret_arn_list = [aws_secretsmanager_secret.sm[0].arn]
+  secret_arn_list = compact(concat([aws_secretsmanager_secret.sm[0].arn], var.extra_scram_secret_arns))
 }
 
 resource "aws_appautoscaling_target" "default" {

modules/aws-msk-apache-kafka-cluster-master/outputs.tf

@@ -66,7 +66,8 @@ output "username" {
 
 output "password" {
   value       =  var.client_sasl_scram_enabled ? random_password.password[0].result : null
-  description = ""
+  description = "Generated SCRAM password of the module-managed user"
+  sensitive   = true
 }
 
 output "cluster_uuid" {

modules/aws-msk-apache-kafka-cluster-master/variables.tf

@@ -119,6 +119,12 @@ variable "client_sasl_scram_secret_association_arns" {
   description = "List of AWS Secrets Manager secret ARNs for scram authentication (cannot be set to `true` at the same time as `client_tls_auth_enabled`)."
 }
 
+variable "extra_scram_secret_arns" {
+  type        = list(string)
+  default     = []
+  description = "Additional AWS Secrets Manager secret ARNs of per-user SCRAM credentials to associate with the cluster alongside the module-managed secret. The secrets and their values are managed out-of-band; pass ARNs only. MSK rejects secrets encrypted with the Secrets Manager default key, so each secret must use the cluster's KMS key (`encryption_at_rest_kms_key_arn`)."
+}
+
 variable "client_sasl_iam_enabled" {
   type        = bool
   default     = false