From ace8bda4f1717c8e5e96d4f71198f95044d2157a Mon Sep 17 00:00:00 2001
From: luizm <luizmuller.it@gmail.com>
Date: Wed, 20 May 2026 16:22:04 -0300
Subject: [PATCH] feat: support aws profile

---
 cmd/kaf/oauth.go          | 13 +++++++++++--
 examples/aws_msk_iam.yaml |  1 +
 pkg/config/config.go      |  1 +
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/cmd/kaf/oauth.go b/cmd/kaf/oauth.go
index a5248c45..85ea1828 100644
--- a/cmd/kaf/oauth.go
+++ b/cmd/kaf/oauth.go
@@ -47,11 +47,20 @@ func newTokenProvider() *tokenProvider {
 
 		// token either from tokenURL, static or AWS API
 		if cluster.SASL.Mechanism == "AWS_MSK_IAM" {
-			cfg, err := aws_config.LoadDefaultConfig(ctx)
+			var awsOpts []func(*aws_config.LoadOptions) error
+			if cluster.SASL.AWSProfile != "" {
+				awsOpts = append(awsOpts, aws_config.WithSharedConfigProfile(cluster.SASL.AWSProfile))
+			}
+			cfg, err := aws_config.LoadDefaultConfig(ctx, awsOpts...)
 			if err != nil {
 				errorExit("Could not load AWS config: " + err.Error())
 			}
-			token, _, err := aws_signer.GenerateAuthToken(ctx, cfg.Region)
+			var token string
+			if cluster.SASL.AWSProfile != "" {
+				token, _, err = aws_signer.GenerateAuthTokenFromProfile(ctx, cfg.Region, cluster.SASL.AWSProfile)
+			} else {
+				token, _, err = aws_signer.GenerateAuthToken(ctx, cfg.Region)
+			}
 			if err != nil {
 				errorExit("Could not generate auth token: " + err.Error())
 			}
diff --git a/examples/aws_msk_iam.yaml b/examples/aws_msk_iam.yaml
index 5312b73d..044bd9dc 100644
--- a/examples/aws_msk_iam.yaml
+++ b/examples/aws_msk_iam.yaml
@@ -4,6 +4,7 @@ clusters:
       - localhost:9092
     SASL:
       mechanism: AWS_MSK_IAM
+      # awsProfile: my-profile  # optional: use a named AWS profile instead of env vars or the default profile
     TLS: null
     security-protocol: SASL_SSL
 # set the region using the AWS_REGION envvar or saved profiles
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 698ee07b..bcaef0f1 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -19,6 +19,7 @@ type SASL struct {
 	Scopes       []string `yaml:"scopes"`
 	Token        string   `yaml:"token"`
 	Version      int16    `yaml:"version"`
+	AWSProfile   string   `yaml:"awsProfile"`
 }
 
 type TLS struct {