The best Kafka UI tool for Amazon MSK is one that signs in the way the cluster already authenticates clients, over IAM, SASL/SCRAM or mTLS, works on MSK Serverless, reads records serialised with the AWS Glue Schema Registry, manages MSK Connect, and adds per-person roles, time-boxed production access, masking and an audit trail on top of IAM, from one container in your own AWS account that stays out of the data path. Kpow, Kafbat UI, Lenses, AKHQ, the Amazon MSK console with CloudWatch, Redpanda Console and Conduktor each cover part of that. Scored on the six weighted criteria explained below the rankings, Kpow ranks first with 100 out of 110, ahead of Kafbat UI at 78 and Lenses at 75; Conduktor, listed last, totals 76.
Tools compared
| Rank | Tool | Total (out of 110) | Governance beyond IAM | IAM, SCRAM and mTLS | MSK Connect and Glue | Out of the data path | MSK Serverless | Inspecting topic data | Cost a year, one cluster (modelled) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | Kpow | 100 | RBAC, staged approvals, temporary access, masking, tenants, audit | All three documented, with example IAM policies | Both, with cross-account STS roles | One container, no external database, not a proxy | Supported; audit topic keeps one day, no disk metrics | kJQ search, data inspect, replay | $7,380 |
| 2 | Kafbat UI | 78 | RBAC, global masking, opt-in audit | IAM, with an MSK setup guide | Glue through a serde plugin | One container | Setup guide written for Serverless | Message browsing | $8,640 |
| 3 | Lenses | 75 | SSO and RBAC from Team tier, audit | IAM documented | Glue only | HQ on PostgreSQL plus an agent per cluster | Dedicated guide | SQL over topics | $20,882 |
| 4 | AKHQ | 70 | Group roles, no masking | IAM documented, library bundled | Glue deserialise only; no MSK Connect | One container | Not documented | Message browsing | $8,640 |
| 5 | Amazon MSK console and CloudWatch | 63 | IAM policies per principal | Your AWS identity | Separate AWS and Glue consoles | Nothing to deploy | Metrics only; topic views are Provisioned 3.6+ | Topic configuration, no records | $11,520 |
| 6 | Redpanda Console | 62 | Behind a paid Enterprise licence | IAM accepted; timeouts on large IAM clusters | Neither documented | One container | Not documented | Message browsing | $8,640 plus an unpublished licence for RBAC |
| 7 | Conduktor | 76 | Strong; data-level controls through Gateway | IAM | Glue only | Console on PostgreSQL; Gateway, a proxy, for data-level controls | Provisioned and Serverless, per a 2022 AWS blog | Message browsing | $32,880, or $92,880 with Gateway |
The tools, ranked for MSK
Rank 1 Kpow
100 out of 110 Total
Try Kpow in the live demo No signup needed.
- Cost a year
- $4,500 per cluster with 100 users included, plus about $2,880 in operator time, so $7,380 on one cluster (modelled)
- MSK sign-in
- IAM, SASL/SCRAM and mTLS; Provisioned and Serverless
- Deployment
- One container on ECS, Fargate or EKS, no external database
- Governance beyond IAM ×3 weight, this criterion counts 3 times toward the total
- 9 out of 10
- IAM, SCRAM and mTLS ×2 weight, this criterion counts 2 times toward the total
- 9 out of 10
- MSK Connect and Glue ×2 weight, this criterion counts 2 times toward the total
- 10 out of 10
- Out of the data path ×2 weight, this criterion counts 2 times toward the total
- 9 out of 10
- MSK Serverless
- 8 out of 10
- Inspecting topic data
- 9 out of 10
Why these scores for Kpow
- Governance beyond IAM 9 out of 10
- RBAC per action and resource, staged approvals, time-boxed temporary policies, masking in data inspect, tenants for shared clusters, sign-in through SAML, OIDC or LDAP including AWS IAM Identity Center, and an audit log that names the person are all documented as Enterprise features.
- IAM, SCRAM and mTLS 9 out of 10
- Kpow’s MSK documentation gives working settings for IAM on 9098, SCRAM-SHA-512 on 9096 and mTLS on 9094, with example IAM policies from admin to single-cluster scope.
- MSK Connect and Glue 10 out of 10
- It is the only tool on this page whose documentation covers both MSK Connect, through the MSK Connect API, and Glue Schema Registry, each with cross-account role assumption.
- Out of the data path 9 out of 10
- It runs as one container or JAR and keeps its snapshots, metrics and audit log in topics on your own cluster, with no dependency beyond Kafka, and connects to MSK like any Kafka client, so it sits beside the cluster rather than in front of it; only the MSK console, with nothing to deploy, scores higher.
- MSK Serverless 8 out of 10
- Serverless is supported with one setting, KAFKA_VARIANT=MSK_SERVERLESS, but Kpow’s own documentation says its audit topic keeps only one day there and broker disk metrics are unavailable.
- Inspecting topic data 9 out of 10
- Belong’s engineers name kJQ querying, message visualisation, replay and PII masking as the reasons they use Kpow on MSK.
On MSK. Kpow’s MSK cluster documentation covers Provisioned and Serverless clusters, IAM access control with the AWS_MSK_IAM mechanism, SCRAM-SHA-512 from Secrets Manager and mTLS. MSK Connect is read and managed through the MSK Connect API using the default credentials chain, static keys or an STS role in another account, and the Glue Schema Registry connects by ARN in the same three ways. Kpow added MSK IAM authentication in release 83 (September 2021), the AWS Glue Schema Registry in release 84 (September 2021), and MSK Serverless and MSK Connect in release 89.1 (August 2022).
Buying it through AWS. Two AWS Marketplace listings bill Kpow on your AWS invoice. Kpow for Apache Kafka (Annual) is $4,500 per cluster credit a year, checks entitlements through AWS License Manager and can be bought inside an Enterprise Discount Program by private offer. Kpow for Apache Kafka (Hourly) is $0.40 per container hour for one cluster per running container, which is $3,504 for a container left on all year. Details are in the AWS Marketplace installation guide. It is also listed in the Amazon EKS User Guide as the EKS add-on factorhouse_kpow.
Where it falls short. On MSK Serverless the audit log topic keeps one day, so ship audit events to a webhook or your SIEM, and broker disk metrics are not available because MSK does not expose them. Kpow governs people working through Kpow. Applications still authenticate to MSK with their own IAM roles or SCRAM users, and IAM policies or Kafka ACLs remain the control for them. RBAC, masking, staged mutations and the audit log need Kpow Enterprise; Community Edition is free for 3 clusters and 10 users, and covers MSK IAM sign-in, MSK Connect and the AWS Glue Schema Registry, per the Kpow features page.
Compare Kpow vs LensesKpow vs Kafbat UI
Rank 2 Kafbat UI
78 out of 110 Total
- Cost a year
- $0 licence, about $8,640 in operator time (modelled)
- MSK sign-in
- IAM, with a Serverless setup guide
- Glue
- Separate serde plugin
- Governance beyond IAM ×3 weight, this criterion counts 3 times toward the total
- 6 out of 10
- IAM, SCRAM and mTLS ×2 weight, this criterion counts 2 times toward the total
- 8 out of 10
- MSK Connect and Glue ×2 weight, this criterion counts 2 times toward the total
- 5 out of 10
- Out of the data path ×2 weight, this criterion counts 2 times toward the total
- 9 out of 10
- MSK Serverless
- 8 out of 10
- Inspecting topic data
- 8 out of 10
Why these scores for Kafbat UI
- Governance beyond IAM 6 out of 10
- It offers LDAP and OIDC sign-in, resource-level RBAC, global masking and an opt-in audit topic, which is one grade below the commercial tools.
- IAM, SCRAM and mTLS 8 out of 10
- Its MSK setup guide gives the AWS_MSK_IAM connection settings and an example IAM policy, a clean pass, with SCRAM and mTLS left to ordinary Kafka client properties.
- MSK Connect and Glue 5 out of 10
- Its feature list names AWS Glue among its serializers and the Glue serde is published as a separate plugin, and its documentation does not mention MSK Connect.
- Out of the data path 9 out of 10
- It is a self-hosted container with no database, the same pass as Kpow and the other open-source UIs.
- MSK Serverless 8 out of 10
- Kafbat UI publishes an MSK setup guide written for MSK Serverless, with the AWS_MSK_IAM settings and an example IAM policy, a clean pass without published limits or caveats.
- Inspecting topic data 8 out of 10
- Message browsing and inspection are core features of the open-source UI.
On MSK. Kafbat UI’s MSK setup guide covers Serverless and Provisioned clusters over IAM, and its documentation describes an AWS Marketplace listing for launching it on EC2. Its feature list names AWS Glue among its serializers, and Glue-encoded records are decoded by the ui-serde-glue plugin, which needs its own IAM permissions on the registry. Its audit log is switched on per cluster with the topic-audit-enabled and console-audit-enabled settings. The Kafbat UI review covers its release history and RBAC in detail.
Where it falls short. No vendor stands behind it, MSK Connect is not documented, and Glue decoding is an extra plugin to version and configure. Its modelled running cost on one cluster is 6 engineer-hours a month, $8,640 a year at $120 an hour.
Rank 3 Lenses
lenses.io
75 out of 110 Total
- Cost a year
- $18,002 software on the smallest AWS Marketplace EC2 listing plus $2,880 operator time, so $20,882 before EC2 charges (modelled)
- MSK sign-in
- IAM, with an MSK Serverless guide
- Deployment
- HQ on PostgreSQL plus an agent and database per cluster
- Governance beyond IAM ×3 weight, this criterion counts 3 times toward the total
- 7 out of 10
- IAM, SCRAM and mTLS ×2 weight, this criterion counts 2 times toward the total
- 8 out of 10
- MSK Connect and Glue ×2 weight, this criterion counts 2 times toward the total
- 6 out of 10
- Out of the data path ×2 weight, this criterion counts 2 times toward the total
- 4 out of 10
- MSK Serverless
- 8 out of 10
- Inspecting topic data
- 10 out of 10
Why these scores for Lenses
- Governance beyond IAM 7 out of 10
- SSO, SAML and RBAC come from the Team tier and audit logs are in the product, one grade below the tools with approvals and time-boxed access.
- IAM, SCRAM and mTLS 8 out of 10
- Lenses documents AWS_MSK_IAM for its agent, a clean pass.
- MSK Connect and Glue 6 out of 10
- Glue Schema Registry is documented, and MSK Connect is not.
- Out of the data path 4 out of 10
- It is self-hosted, but a central HQ on PostgreSQL plus an agent and an agent database for every cluster is the heaviest footprint here apart from Conduktor with Gateway.
- MSK Serverless 8 out of 10
- It publishes a dedicated MSK Serverless configuration guide, including the IAM statements Glue needs.
- Inspecting topic data 10 out of 10
- SQL over topics is the centre of the product and the strongest query model on this page, ahead of Kpow’s kJQ.
On MSK. Lenses’ documentation (not linked) has an MSK Serverless guide for its agent using AWS_MSK_IAM, and a Glue Schema Registry connection that depends on an AWS connection. It is also sold on AWS Marketplace as Lenses EC2 - MSK, billed hourly from $2.055 an hour on a t2.large, which is $18,002 for an instance left on all year, before the EC2 instance charge.
Where it falls short. The Lenses review records that its default broker metrics refresh of about 5 seconds sends an unexpectedly high volume of JMX requests to MSK’s Prometheus exporter, with 30 seconds or more the recommended workaround. The Team licence stops at 15 users on one cluster, and MSK Connect is not documented.
Compare Kpow vs LensesLenses review
Rank 4 AKHQ
70 out of 110 Total
- Cost a year
- $0 licence, about $8,640 in operator time (modelled)
- MSK sign-in
- IAM, library bundled
- Glue
- Deserialise only, default AWS credentials
- Governance beyond IAM ×3 weight, this criterion counts 3 times toward the total
- 5 out of 10
- IAM, SCRAM and mTLS ×2 weight, this criterion counts 2 times toward the total
- 8 out of 10
- MSK Connect and Glue ×2 weight, this criterion counts 2 times toward the total
- 4 out of 10
- Out of the data path ×2 weight, this criterion counts 2 times toward the total
- 9 out of 10
- MSK Serverless
- 5 out of 10
- Inspecting topic data
- 8 out of 10
Why these scores for AKHQ
- Governance beyond IAM 5 out of 10
- It has LDAP, OIDC and basic sign-in with group-based roles, and no masking or audit comparable to the commercial tools.
- IAM, SCRAM and mTLS 8 out of 10
- AKHQ bundles the MSK IAM library and documents the exact connection properties for AWS_MSK_IAM.
- MSK Connect and Glue 4 out of 10
- AKHQ documents a Glue schema registry type that only deserialises Avro, Protobuf and JSON records using the AWS default credentials chain, and its documentation does not cover MSK Connect.
- Out of the data path 9 out of 10
- It is a self-hosted container with no database.
- MSK Serverless 5 out of 10
- IAM sign-in is the only requirement Serverless places on a client, but AKHQ publishes no Serverless guidance, so it is possible with work you verify yourself.
- Inspecting topic data 8 out of 10
- Topic data browsing is a core AKHQ feature.
On MSK. AKHQ’s AWS MSK IAM guide sets sasl.mechanism to AWS_MSK_IAM with the IAM login module and callback handler, and notes the libraries are already loaded. SCRAM and mTLS are ordinary Kafka client properties. The AKHQ review covers the rest.
Where it falls short. AKHQ’s Glue support is limited to deserialising records, using the AWS default credentials chain, so there is no documented way to browse or change the Glue schemas themselves or to reach a registry in another account. It manages Kafka Connect clusters you point it at by URL, and its documentation does not cover MSK Connect.
Compare Kpow vs AKHQAKHQ review
Rank 5 Amazon MSK console and CloudWatch
63 out of 110 Total
- Cost a year
- $0 licence and nothing to run; reading records falls to the Kafka CLI, modelled at 8 hours a month, $11,520 (modelled)
- MSK sign-in
- Your AWS console identity and IAM
- Deployment
- Nothing to deploy
- Governance beyond IAM ×3 weight, this criterion counts 3 times toward the total
- 3 out of 10
- IAM, SCRAM and mTLS ×2 weight, this criterion counts 2 times toward the total
- 8 out of 10
- MSK Connect and Glue ×2 weight, this criterion counts 2 times toward the total
- 7 out of 10
- Out of the data path ×2 weight, this criterion counts 2 times toward the total
- 10 out of 10
- MSK Serverless
- 3 out of 10
- Inspecting topic data
- 1 out of 10
Why these scores for Amazon MSK console and CloudWatch
- Governance beyond IAM 3 out of 10
- IAM policies decide what each principal may do, and the console adds no masking, no approval step for destructive changes and no per-person view of topic data.
- IAM, SCRAM and mTLS 8 out of 10
- It uses your AWS identity and IAM permissions directly, although SCRAM users and mTLS certificates play no part in what the console shows.
- MSK Connect and Glue 7 out of 10
- MSK Connect is managed in the AWS console and Glue schemas in the Glue console, two separate places that are not joined to the topics that use them.
- Out of the data path 10 out of 10
- There is nothing to deploy and nothing between clients and brokers, since this is AWS’s own control plane, which makes it the best on this criterion.
- MSK Serverless 3 out of 10
- AWS’s announcements put the new topic viewing and management APIs on Provisioned clusters running Kafka 3.6 and above, so Serverless clusters get CloudWatch metrics but not the topic views.
- Inspecting topic data 1 out of 10
- The console shows topic configuration, partitions and metrics, and neither AWS announcement describes reading the records themselves.
What it covers. Amazon MSK now lists and describes topics in the console, with partition detail and metrics, through the ListTopics, DescribeTopic and DescribeTopicPartitions APIs (AWS, November 2025), and added CreateTopic, UpdateTopic and DeleteTopic in February 2026. Both apply to Provisioned clusters on Kafka 3.6 and above. Consumer lag is published to CloudWatch as offset lag and estimated time lag.
Where it falls short. There is no way to read or search records, so inspecting a message means the Kafka CLI or a separate tool. Consumer lag metrics are emitted only for consumer groups in a STABLE or EMPTY state, so they pause while a group is rebalancing, and CloudWatch drops them for group names with non-ASCII characters. DEFAULT-level MSK metrics are free, and the PER_BROKER, PER_TOPIC_PER_BROKER and PER_TOPIC_PER_PARTITION levels are billed at CloudWatch rates. Providers often do a great job monitoring the cluster itself, and MSK is no exception; the gap is the application side, which is your code.
Rank 6 Redpanda Console
redpanda.com
62 out of 110 Total
- Cost a year
- $0 for the free build, about $8,640 in operator time (modelled); RBAC and SSO need an unpublished Enterprise licence
- MSK sign-in
- AWS_MSK_IAM in the SASL block
- Glue
- None documented
- Governance beyond IAM ×3 weight, this criterion counts 3 times toward the total
- 6 out of 10
- IAM, SCRAM and mTLS ×2 weight, this criterion counts 2 times toward the total
- 6 out of 10
- MSK Connect and Glue ×2 weight, this criterion counts 2 times toward the total
- 1 out of 10
- Out of the data path ×2 weight, this criterion counts 2 times toward the total
- 9 out of 10
- MSK Serverless
- 4 out of 10
- Inspecting topic data
- 8 out of 10
Why these scores for Redpanda Console
- Governance beyond IAM 6 out of 10
- RBAC, OIDC sign-in and masking exist but need a paid Redpanda Enterprise licence, and Console shuts down if that licence expires.
- IAM, SCRAM and mTLS 6 out of 10
- Its configuration accepts AWS_MSK_IAM with region and credentials, but the Redpanda Console review records hardcoded request timeouts that large MSK clusters on IAM regularly exceed.
- MSK Connect and Glue 1 out of 10
- Redpanda’s documentation describes no Glue support and does not mention MSK Connect.
- Out of the data path 9 out of 10
- It is a self-hosted container with no database.
- MSK Serverless 4 out of 10
- No MSK Serverless guidance is published, and the request timeouts recorded for large IAM clusters apply there too.
- Inspecting topic data 8 out of 10
- Message browsing is the core of the product.
On MSK. Redpanda’s Console configuration documentation (not linked) takes AWS_MSK_IAM in its SASL block with a region, custom endpoint and either static credentials or the instance role. The Redpanda Console review records the practical limit on MSK: GetClusterInfo has a 6-second timeout and GetTopicsOverview 5 seconds, and on large MSK clusters with IAM authentication those limits are regularly exceeded because the token exchange adds latency.
Where it falls short. A team on Amazon MSK buys a Redpanda licence to get RBAC, SSO or masking, and that price is not published. There is no documented Glue Schema Registry support.
Rank 7 Conduktor
conduktor.io
76 out of 110 Total
- Cost a year
- 25 Console seats at $1,200 is $30,000 plus $2,880 operator time, so $32,880; Gateway core adds $60,000 (modelled)
- MSK sign-in
- IAM
- Deployment
- Console on PostgreSQL 13+; data-level controls through Gateway, a proxy
- Governance beyond IAM ×3 weight, this criterion counts 3 times toward the total
- 9 out of 10
- IAM, SCRAM and mTLS ×2 weight, this criterion counts 2 times toward the total
- 8 out of 10
- MSK Connect and Glue ×2 weight, this criterion counts 2 times toward the total
- 6 out of 10
- Out of the data path ×2 weight, this criterion counts 2 times toward the total
- 3 out of 10
- MSK Serverless
- 7 out of 10
- Inspecting topic data
- 8 out of 10
Why these scores for Conduktor
- Governance beyond IAM 9 out of 10
- RBAC, SSO by OIDC or LDAP, an audit log and masking are strong, but encryption, field-level masking of the data itself and multi-tenancy run through Gateway.
- IAM, SCRAM and mTLS 8 out of 10
- The Conduktor review records IAM authentication for MSK, a clean pass.
- MSK Connect and Glue 6 out of 10
- AWS Glue Schema Registry is supported, and MSK Connect is not documented.
- Out of the data path 3 out of 10
- Console needs PostgreSQL 13 or later, and the data-level controls counted in its governance score run in Gateway, a proxy that clients connect through, so using them puts Conduktor in the data path.
- MSK Serverless 7 out of 10
- A 2022 AWS Big Data Blog post by Conduktor’s co-founder describes Conduktor monitoring both provisioned and serverless MSK clusters over IAM, a pass on older evidence with no current Serverless limits published.
- Inspecting topic data 8 out of 10
- Console browses and filters topic data.
On MSK. The Conduktor review records Console support for MSK with IAM authentication and for AWS Glue Schema Registry, and an AWS Big Data Blog post from December 2022 by Conduktor’s co-founder describes it monitoring provisioned and serverless MSK clusters. Conduktor’s Gateway documentation (not linked) describes Gateway as a Kafka proxy between client applications and brokers, which is where its encryption, masking of the data itself and virtual clusters for multi-tenancy are enforced.
Where it falls short. Console connects to MSK directly and needs PostgreSQL. Conduktor’s data-level controls, such as encryption, masking of the data itself and virtual clusters for multi-tenancy, run in Gateway, a Kafka proxy that client applications connect through, which puts Gateway in the data path for those clients. On AWS Marketplace, Conduktor Enterprise lists Gateway core at $60,000 a year and Console at $1,200 a seat for the first 100 seats.
Compare Conduktor review
What teams on Amazon MSK need
Amazon MSK runs the brokers for you. It does not give engineers a way to read the records in a topic, and it leaves the question of who may do what, once several teams share a cluster, to IAM policies written per principal. Everything on this page is about what a tool adds on top of the service, not about replacing it. For the broader field of Kafka tools on any distribution, see the best Kafka management tools.
Three things come up once a team is running MSK in production. The tool has to connect with the same authentication the cluster already enforces, without a separate set of long-lived credentials. It has to understand the AWS services around the cluster, MSK Connect and the Glue Schema Registry, because otherwise engineers see undecoded bytes and connectors they cannot manage. And it has to answer the governance questions IAM leaves open, because IAM authorises the principal that connects, and when twenty engineers share one tool that principal is the tool’s role.
IAM is one of three sign-in options on Provisioned clusters and the only one on Serverless. The client needs the MSK IAM library on its classpath, the AWS_MSK_IAM SASL mechanism, and a role with kafka-cluster permissions on the cluster, topics and groups it will touch. Every third-party tool on this page can be made to connect that way, and the difference is in what is documented. Kpow publishes three example policies, from admin across every cluster in an account down to one cluster and its topics and groups. Kafbat UI publishes an MSK setup guide with an example policy, AKHQ publishes the connection properties, and Redpanda Console accepts the mechanism in its configuration, with its review recording the timeouts large IAM clusters run into. Kpow can also reach MSK Connect and a Glue registry in another AWS account by assuming an STS role, configured with the CONNECT_STS_ROLE_ARN and SCHEMA_REGISTRY_STS_ROLE_ARN settings.
On Serverless, Kpow sets its internal topics to the Serverless constraints with KAFKA_VARIANT=MSK_SERVERLESS, and its documentation is explicit about the cost: its audit log topic keeps one day on Serverless, and broker disk metrics are not available. The retry visibility walkthrough for Lambda functions triggered by MSK shows Kpow connected to an MSK Serverless cluster over IAM.
MSK Connect and the Glue Schema Registry are where MSK tools diverge most. Kpow reads and manages MSK Connect connectors through the MSK Connect API, and connects to Glue by registry ARN, each with the default AWS credentials chain, static keys or an STS role in another account. Lenses and Conduktor document Glue. Kafbat UI lists AWS Glue among its serializers and publishes the Glue serde as a separate plugin. AKHQ can deserialise Glue-encoded records using the AWS default credentials chain, with no cross-account role option. Redpanda Console documents no Glue Schema Registry support, and none of the tools other than Kpow documents MSK Connect. Schema choices are covered more broadly in Kafka schema registry tools.
IAM does not provide roles per person rather than per principal, masking of sensitive fields, an approval step in front of offset resets and topic deletion, or an audit record of each engineer’s actions. Those are what a shared tool has to add once more than one team works on the same cluster.
One requirement cuts across all three: where the tool runs. A tool that runs as a container in your own VPC, next to the cluster, and connects to MSK the way any Kafka client does, adds nothing to the path your producers and consumers take. A tool whose controls are enforced by a proxy that every client connects through becomes part of that path, and it has to be sized, kept available and kept in step with every client upgrade. Kpow is one container with no external database, installed in your own environment and out of the data path. Conduktor Console also connects to MSK directly, with a PostgreSQL database of its own; Conduktor’s data-level controls, such as encryption, masking of the data itself and virtual clusters, run in Conduktor Gateway, a Kafka proxy that client applications connect through.
Who runs Kpow on Amazon MSK
One Kpow customer has described in public how it runs Kpow on Amazon MSK: Belong, the Australian telco that is part of Telstra, in a talk by its Head of Enablement. The card is tagged with the rubric criteria its evidence speaks to, and the grey tags name the other things the talk covers.
Which customer shows which criterion
- Governance beyond IAM
- Belong
- IAM, SCRAM and mTLS
- Belong
- Inspecting topic data
- Belong
-
Belong
- IAM, SCRAM and mTLS
- Inspecting topic data
- Governance beyond IAM
- AWS Glue Schema Registry
- Incident replay
- Terraform-managed ACLs
Belong runs Kafka on Amazon MSK across multiple availability zones, secured with SASL/SCRAM and per-topic ACLs managed through Terraform, and uses the AWS Glue Schema Registry because, in Nagaraj Ballapuram Gopal’s words, “given we’re on AWS MSK, we can’t use Confluent’s schema registry”. To look inside topics the team bought Kpow, for four reasons he lists: real-time querying with kJQ, visualising messages, replaying messages during production issues, and “the PII masking feature in Kpow, which lets us mask fields like mobile number, first name, last name, or address.” He says masking has helped with Belong’s cyber security and risk teams and helps prevent people copying data out.
How a team runs Amazon MSK with Kpow
Installing it in the account. A team starts Kpow as an ECS task on Fargate from the CloudFormation templates, installs it on EKS with the Helm charts, or subscribes on AWS Marketplace and gets a container licensed to its AWS account, billed on the AWS invoice. Amazon also lists Kpow as the EKS add-on factorhouse_kpow in the Amazon EKS User Guide. The full walkthrough is Set up Kpow with Amazon MSK.
Signing in to the cluster. Kpow connects over IAM on port 9098 with the AWS_MSK_IAM mechanism, SCRAM-SHA-512 on 9096 or mTLS on 9094, and takes its AWS credentials from the task or pod role. Its MSK cluster documentation gives three example IAM policies, from admin across every cluster in an account down to one cluster and its topics and groups. On MSK Serverless the team sets KAFKA_VARIANT=MSK_SERVERLESS so Kpow creates its internal topics within the Serverless limits.
Signing people in. Engineers sign in to Kpow through AWS IAM Identity Center over SAML, or through Okta, Microsoft Entra ID, Keycloak, OIDC or LDAP, so access follows the company directory rather than a shared IAM user.
Reading Glue-encoded topics. Kpow connects to the AWS Glue Schema Registry by ARN, so data inspect shows Glue-serialised records decoded, and engineers filter them across topics with kJQ. A registry in another AWS account is reached by assuming an STS role.
Running MSK Connect. Kpow reads connector and task status and configuration through the MSK Connect API, and with the documented IAM permissions it can create, update, stop, start and delete connectors, including in another account through an STS role.
Watching lag and brokers. Kpow shows each consumer group down to partition level and resets, clears or skips offsets from the same view, and its brokers view shows broker configuration and detects under-replicated partitions. Consumer group lag and other computed metrics are exported to Prometheus alongside CloudWatch.
Giving teams their own view of a shared cluster. Tenants limit which topics, groups and connectors each role can see, RBAC sets what each person may do, staged mutations hold an offset reset or topic deletion for approval, temporary policies grant production access that expires at a set time, and data policies mask sensitive fields in data inspect results on the server.
Keeping the record. The audit log records each action with the user from the identity provider, and a webhook sends those records to Slack, Microsoft Teams or any endpoint, which is how a team on MSK Serverless keeps audit history beyond the one-day retention of Kpow’s audit topic there.
The public Kpow demo runs on two Amazon MSK clusters, MSK Primary and MSK Secondary, and needs no signup. It shows brokers, topics, consumer groups, the Kafka Connect cluster on MSK Primary, the AWS Glue schema registry, and the __oprtr_audit_log topic on MSK Secondary; sign-in, masking and temporary policies are the things to test in your own account.
How Factor House approaches it
Kpow is built to sit next to MSK rather than in front of it. It runs as one container in your own account, connects to your brokers with the same configuration as a Kafka producer or consumer, and needs no external database, so applications keep talking to the brokers directly. The public Kpow demo itself runs on two MSK clusters, MSK Primary and MSK Secondary, and in the September 2026 product update the demo’s schema registries were described as AWS Glue, Karapace and Confluent.
Both AWS Marketplace listings deliver a container that is licensed to the subscribing AWS account and billed on its AWS invoice, with every Kpow release published there. Annual checks entitlements through AWS License Manager and is eligible for an Enterprise Discount Program by private offer; Hourly meters each running container.
Amazon lists Kpow in the Amazon EKS User Guide as an AWS Marketplace add-on, factorhouse_kpow, published by Factor House, with its service account and the AWSLicenseManagerConsumptionPolicy it needs. On AWS Marketplace the Kpow Annual listing averaged 4.6 out of 5 across 9 ratings and the Hourly listing 4.4 out of 5 across 5 ratings when read on 30 September 2026, with one Annual reviewer describing “a nifty UI for understanding our kafka clusters and topics without needing to resort to the command line.”
Where Kpow does not win: on Serverless its audit topic keeps only one day and broker disk metrics are missing, both because of MSK’s own limits. It governs people working through Kpow, so applications keep their own IAM roles or SCRAM users, and IAM policies or Kafka ACLs stay the control for them. Lenses has the stronger query model with SQL over topics, and the MSK console needs nothing deployed at all.
Chad Harris covers governing a shared MSK cluster for teams and AI agents in the Beyond IAM tech talk.
Kpow live demo
See Kpow running on Amazon MSK
The live Kpow demo is connected to two Amazon MSK clusters. Open MSK Primary to see its Kafka Connect cluster, then browse brokers, topics, consumer groups and the AWS Glue schema registry, with no signup.
For platform teams choosing a Kafka tool for MSK.
Try the Kpow demoFAQ
What is the best Kafka UI for Amazon MSK?
On this page’s rubric, Kpow, with 100 of 110 points: it signs in over IAM, SCRAM or mTLS, supports MSK Serverless, manages MSK Connect, reads the AWS Glue Schema Registry, adds per-person roles, masking, approvals and an audit trail on top of IAM, and runs as one container in your VPC outside the data path. Kafbat UI is the highest-scoring free open-source option.
What is the best Kafka UI for MSK Serverless?
Kpow has the highest total on this page and, like Kafbat UI and Lenses, scores 8 of 10 on the MSK Serverless criterion. It connects over IAM, the only method Serverless accepts, and documents a KAFKA_VARIANT=MSK_SERVERLESS setting that creates its internal topics within Serverless limits, with two stated trade-offs: its audit topic keeps one day and broker disk metrics are unavailable (Kpow MSK cluster docs). Kafbat UI also publishes a Serverless setup guide, and Lenses publishes a Serverless configuration guide.
Which Kafka UI can read messages serialised with the AWS Glue Schema Registry?
Kpow connects to a Glue registry by ARN, including one in another AWS account through an STS role, and decodes Glue-encoded records in data inspect. Lenses and Conduktor document Glue support, Kafbat UI decodes Glue through a serde plugin, and AKHQ deserialises Glue records using the default AWS credentials. Redpanda Console documents no Glue Schema Registry support. Registries beyond Glue are compared in Kafka schema registry tools.
Can a Kafka UI manage MSK Connect connectors?
MSK Connect connectors are created and described through the MSK Connect API. Kpow is the only tool on this page that documents MSK Connect, reading connector and task status and, with the IAM permissions shown in its docs, creating, updating, stopping, starting and deleting connectors, across accounts through an STS role.
Is there a free Kafka UI for Amazon MSK?
Kpow Community Edition is free on up to 3 clusters and 10 users and includes MSK IAM sign-in, MSK Connect and the AWS Glue Schema Registry. Kafbat UI and AKHQ are open source. RBAC, masking, staged approvals and the audit log need Kpow Enterprise. More free options are compared in the best free Kafka UI tools.
Does a Kafka UI need to sit in the data path to govern access on MSK?
No. Kpow runs as one container in your account, connects to MSK like any Kafka client and applies roles, masking, approvals and the audit trail to the people working through it, so producers and consumers keep connecting straight to the brokers. Conduktor Console also connects directly, while Conduktor’s data-level controls run in Gateway, a Kafka proxy that client applications connect through.
Does AWS provide a Kafka UI for Amazon MSK?
The MSK console lists and describes topics, partitions and configuration on Provisioned clusters running Kafka 3.6 and above, and can create, update and delete topics. It does not show the records in a topic, so reading or searching messages needs the Kafka CLI or a separate tool.
Which Kafka UI tools support MSK IAM authentication?
Kpow, Kafbat UI, AKHQ, Lenses, Redpanda Console and Conduktor all accept the AWS_MSK_IAM SASL mechanism. Kpow and Kafbat UI publish example IAM policies for MSK, and Kpow also documents SCRAM-SHA-512 and mTLS on MSK. They differ in what they document beyond sign-in: MSK Serverless, MSK Connect and the AWS Glue Schema Registry.
Can a Kafka UI be bought through AWS Marketplace and billed on the AWS invoice?
Yes. Kpow is listed as Annual, at $4,500 per cluster credit and eligible for an Enterprise Discount Program by private offer, and as Hourly, at $0.40 per container hour. Lenses and Conduktor also have AWS Marketplace listings, and Kafbat UI can be launched from AWS Marketplace on EC2.
Does a Kafka UI replace IAM policies on MSK?
No. IAM policies, or Kafka ACLs on SCRAM and mTLS clusters, still control what applications can do. A tool such as Kpow adds per-person roles, masking, approvals and an audit trail for the engineers who work through it.
How these tools were scored
Five of the six criteria start from Amazon’s MSK documentation; the sixth is where the tool runs. They are listed here in order of weight. Each criterion is scored 0 to 10: 10 where a tool is the only one here doing it or clearly the best, 8 for a clean documented pass, 5 or 6 for partial support or support that needs work the reader must verify, 1 to 4 for a weak or indirect form, and 0 where it is absent.
1. Governance beyond IAM (counts three times). IAM decides what a principal may do. It has no per-person view of data, no masking, no approval step before a topic is deleted and no audit trail of what an engineer looked at. This criterion scores per-person roles, production access granted on request and expiring, masking, directory sign-in, tenants for teams sharing a cluster, and an audit trail that names the person. The requirements for regulated teams are covered in Kafka governance tools for financial services, and the masking options are compared in Kafka data masking tools.
2. IAM, SCRAM and mTLS (counts twice). MSK IAM access control lets clients authenticate with AWS credentials and authorises each Kafka action with an IAM policy. Provisioned clusters also accept SASL/SCRAM with credentials held in Secrets Manager, and mutual TLS. A tool scores well here when it documents all three and can take its AWS credentials from the task or pod role rather than a stored key.
3. MSK Connect and Glue (counts twice). MSK Connect runs managed Kafka Connect workers, and its connectors are created and described through the MSK Connect API. The AWS Glue Schema Registry is the registry most MSK teams use. A tool that speaks only the Kafka Connect REST API and Confluent-compatible registries leaves both out. A tool scores 10 here only when it documents both, including a registry or connectors in another AWS account. Connector tooling on any distribution is compared in Kafka Connect monitoring tools.
4. Out of the data path (counts twice). The tool should run inside your AWS account and VPC, reach the brokers over the same private network your applications use as an ordinary Kafka client, and keep no data outside your own cluster. Scored lower: tools that need an external database of their own, and tools whose controls work only when application traffic passes through a vendor’s proxy. A self-hosted container with no external database and no proxy scores 9, a tool with a database of its own 6, one with several databases or a component on the brokers 4, and one that needs both a database and a proxy for its controls 3; 10 is kept for an option with nothing to deploy at all, here the MSK console. This criterion is scored the same way on every Factor House page that uses it, and only its weight changes with the reader.
5. MSK Serverless (counts once). MSK Serverless accepts IAM authentication only, and its quotas are per cluster: 500 consumer groups, 2,400 partitions for non-compacted topics and 120 for compacted ones, and 2 topic-management API requests a second. A tool that creates its own internal topics has to create them within those limits, and it should say which of its features are affected.
6. Inspecting topic data (counts once). The MSK console now shows topics, partitions and configuration, but not the records. Reading a message, searching a topic for one key or replaying a record after an incident is the day-to-day job engineers need a tool for.
Costs are modelled for one production MSK cluster and 25 engineers at $120 per engineer hour, using the same hours per tool class as Factor House’s other comparison pages. Tools with a licence carry the published price plus 2 hours a month to run. The open-source UIs carry 6 hours a month, $8,640 a year, to run, secure and keep current. The MSK console has no licence and nothing to run, and the Kafka CLI it leaves record reading to is modelled like the other tools with no access control of their own, at 8 hours a month, $11,520 a year. Kpow’s $7,380 uses the Annual price of $4,500 per cluster with 100 users included; on the Hourly listing a container left on all year is $3,504, or $6,384 with running time. Kpow Community Edition is free for 3 clusters and 10 users, so a 25-engineer team is on Enterprise. For free options compared at any team size, see the best free Kafka UI tools.
The criteria map onto the MSK features in the figure below.
Every option is scored from 0 to 10 on each criterion, from the evidence and sources this page cites, and the reason for each score is on its card. The criteria are weighted: Governance beyond IAM counts three times, IAM, SCRAM and mTLS counts twice, MSK Connect and Glue counts twice, Out of the data path counts twice, MSK Serverless counts once and Inspecting topic data counts once, for a total out of 110. Governance beyond IAM counts three times because on a shared MSK cluster IAM authorises the tool's own role, so per-person roles, production access granted on request, masking, directory sign-in, tenants for shared clusters and a per-person audit trail are the only record of which engineer did what. IAM, SCRAM and mTLS, MSK Connect and Glue, and out of the data path count twice: a tool that cannot sign in the way the cluster is configured cannot be used at all, a tool that cannot read Glue-encoded records or manage MSK Connect leaves two AWS services outside it, and a tool that clients connect through becomes part of the path every producer and consumer depends on, while one that needs a database of its own is one more component to run and secure in the VPC. MSK Serverless and inspecting topic data count once, because most third-party tools here pass them. This page is published by Factor House, which makes Kpow. Every option is scored on the same rubric and the same sources: Kpow's per-criterion scores are set the same way as every other option's and are not adjusted, and the weights apply to every option alike. Kpow ranks first on its total of 100 out of 110. The other options follow by total. Conduktor is listed last whatever its total; on its total of 76 it would place third.