Authorization controls whether an authenticated participant may access a requested Kafka resource. Authentication establishes identity; encryption protects data. Kafka ACLs express permissions, commonly at the topic level—a client with topic access can access all data in that topic. section 9.3.1 section 9.2.3
An ACL specifies:
- A principal, such as a user, and the resource type and resource, such as a topic or consumer group. section 9.3.4
- How the resource is matched—by exact name or prefix—and which operation, such as read, write, or describe, is allowed or denied. section 9.3.4
- An optional host restriction; deny rules take precedence over allow rules. section 9.3.4
Topic permissions require care: consumers may also need to commit offsets, use their consumer group, and describe metadata. The kafka-acls utility helps set common permissions, but does not cover some advanced consumer controls or all producer permissions. section 9.3.4 section 9.3.4
Listing 9.8 Setting an ACL for a producer
kafka-acls.sh --bootstrap-server broker:9092 \ #1 --add \ --allow-principal User:card-service \ #2 --operation Write --operation Create \ #3 --resource-pattern-type prefix \ --topic CARDS #4
This command illustrates granting a producer write and create permissions on topics matching a prefix. section 9.3.4
