# Access Denied trying to connect Lenses Agent to MSK Serverless

**URL:** <https://ask.lenses.io/t/access-denied-trying-to-connect-lenses-agent-to-msk-serverless/401>\
**Category:** Lenses\
**Created:** [July 14, 2025, 8:45pm UTC](https://ask.lenses.io/t/access-denied-trying-to-connect-lenses-agent-to-msk-serverless/401 "2025-07-14T20:45:23Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![james1985](https://avatars.discourse-cdn.com/v4/letter/j/c57346/32.png) [@james1985](https://ask.lenses.io/u/james1985)\
**Post date:** [July 14, 2025, 8:45pm UTC](https://ask.lenses.io/t/access-denied-trying-to-connect-lenses-agent-to-msk-serverless/401/1 "2025-07-14T20:45:23Z")

</div>

I’m trying to get Lenses 6 Agent to connect to my MSK Serverless Kafka but I’m getting an `Access Denied` error.

I’ve correctly set an IAM role against the EC2 instance.

Testing even with the kafka-topics.sh, I’m getting the error:

```auto
[2025-07-14 20:13:43,776] ERROR [AdminClient clientId=adminclient-1] Connection to node -1 (boot-0tm6ik1m.c1.kafka-serverless.eu-west-3.amazonaws.com/172.31.18.146:9098) failed authentication due to: [cf8ae020-efff-4d6b-add2-bf451ec58949]: Access denied (org.apache.kafka.clients.NetworkClient)
[2025-07-14 20:13:43,781] WARN [AdminClient clientId=adminclient-1] Metadata update failed due to authentication error (org.apache.kafka.clients.admin.internals.AdminMetadataManager)
org.apache.kafka.common.errors.SaslAuthenticationException: [cf8ae020-efff-4d6b-add2-bf451ec58949]: Access denied Error while executing topic command : [cf8ae020-efff-4d6b-add2bf451ec58949]: Access denied
[2025-07-14 20:13:43,784] ERROR org.apache.kafka.common.errors.SaslAuthenticationException: [cf8ae020-efff-4d6b-add2-bf451ec58949]: Access denied (org.apache.kafka.tools.TopicCommand)

```

---

<div class="post-metadata">

**Author:** ![guillaume.ayme](https://dub1.discourse-cdn.com/flex017/user_avatar/ask.lenses.io/guillaume.ayme/32/64_2.png) [@guillaume.ayme](https://ask.lenses.io/u/guillaume.ayme)\
**Post date:** [July 14, 2025, 8:47pm UTC](https://ask.lenses.io/t/access-denied-trying-to-connect-lenses-agent-to-msk-serverless/401/2 "2025-07-14T20:47:55Z")

</div>

For MSK Serverless, ensure in your IAM role you are specifying `kafka-cluster` and not `kafka` in the IAM Actions.

Eg:

```auto
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "kafka-cluster:*"
            ],
            "Resource": "*"
        }
    ]
}

```

See AWS MSK Serverless [docs](https://docs.aws.amazon.com/msk/latest/developerguide/create-iam-role.html)

This solved the problem for me.