# MSK IAM (AWS SigV4) — Kafka credentials.
#
# Valid ONLY for an MSK source's read credentials (spec.source.credentials when
# spec.source.type is "msk"). Confluent Cloud cannot present IAM, so a cluster
# link that dials MSK (spec.clusterLink.source) must use SASL/SCRAM instead.
iam:
  region: us-east-1   # required — AWS region for SigV4 token signing (no auto-derive)