An access control list (ACL) defines which authenticated principals may perform specific operations on protected Kafka resources. Apply the least-privilege principle by granting only the permissions each service needs. Kafka’s AclAuthorizer evaluates super-admin status, then matching Deny rules, and finally Allow rules. section 13.2.3
Online-shop permissions
Give the checkout service Write permission on checkout.changelog. Give the payment-processing service Read permission on that topic and on its payment-processor consumer group. Give checkout-analytics permissions on checkout.analytics.* and Read permission on checkout.changelog. An ACL can also restrict access by host and use literal or prefixed resource matching. section 13.2.3
Table 13.2 Kafka ACLs structure
| Component |
Options |
Examples |
|---|---|---|
| Principal |
|
|
| Resource type |
|
|
| Pattern type |
|
|
| Resource name |
|
|
| Operation |
|
|
| Permission type |
|
|
| Host |
|
|
Use the ACL structure to inspect principals, resource types, resource names, patterns, operations, permission types, and host restrictions. section 13.2.3
Migrating an unsecured cluster requires coordinating authentication changes before creating and enforcing ACLs. Creating rules for every user at once is more reliable than leaving allow.everyone.if.no.acl.found enabled, but it can affect many services simultaneously; review the rules and test on a separate system first. section 13.2.7
