IAM auth passthrough to MSK with encryption in transit?

[tooptoop4]

my MSK uses IAM auth and only allows TLS connections.
on server A can I have Kafka-proxy running behind ELB with TCP port listener? then server X with IAM role X connecting to Kafka-proxy (server A) and server Y with IAM role Y connecting to Kafka-proxy (server A) ? with the different respective auth details passed through from X and Y?

what command args should I pass to Kafka-proxy?
should I have SSL settings between serverX and Kafka-proxy?