curl -LO https://github.com/aws/aws-msk-iam-auth/releases/download/v2.3.6/aws-msk-iam-auth-2.3.6-all.jar

before click Finish, make sure the 'Unzip...' option is disabled. 

once the plugin project created, right click on the new project, select Export -> Export ..., then select the 'Deployable plugin-ins and fragments

then install the plugin into the host repository:

3. After restart the BusinessStudio, we can begin the kafka plugin side setup. Frist add a jaas config file to specify the login module, use the following as an example:

KafkaClient {
  software.amazon.msk.auth.iam.IAMLoginModule required
  awsRoleArn="arn:aws:iam::123456789012:role/your-role-name"
  awsRoleSessionName="bwkafka";
};

the awsRoleArn and awsRoleSessionName are for the role based credential(temporary credential) only, If the IAM user has permission to access to MSK, do not setup these 2 properties. The jaas configuration string must end with a semi-comma.

4. Import the TIBCO bundled JRE's cacerts to the plugin, and create a keystore. The password for the JRE default keystore is changeit.

5. Create a Kafka Connection shared resource:

• use the bootstrap url that provided by the MSK in the bootstrap-server. 
• enable the 'SSL' and choose the keystore we created at step 4.
• Change the Authentication Type to OAuthBearer, and select the JAAS file we created at step 3.
• Keep the Login Callback Handler empty.

6. add the plugin project we created at step 2 to both application project and application module project. 

7. in the Kafka Activity, in the Advanced tab, add the following additional properties:

sasl.mechanism=AWS_MSK_IAM
sasl.client.callback.handler.class=software.amazon.msk.auth.iam.IAMClientCallbackHandler

Now the plugin setup is done. The msk-iam-auth is using the DefaultCredentialsProviderChain to find the credentials. To verify the setup in the design time, we can configure the AccessKey and Secret Key in the Environment:

TIBCO ActiveMatrix BusinessWorks Plug-in for Apache Kafka design time does not directly have the option to support the IAM authentication, to enable this authentication type, please referring to the following steps.