Kafka security protects the enterprise architecture through authentication, authorization, and encryption. Authentication verifies identities, authorization controls resource access, and encryption protects data from disclosure. These controls apply across client-broker traffic, broker replication, broker-controller communication, and integrations such as Kafka Connect and Schema Registry. section 9.3.1
A practical Kafka security design addresses:
- Authentication with mechanisms such as mTLS or SASL. section 9.0 section 9.3.1
- Authorization through ACLs, with permissions managed at topic level and therefore potentially covering all data in an accessible topic. section 9.2.3
- Encryption in transit with TLS, plus protection for data at rest and optional end-to-end encryption. section 9.0 section 1.6.1
- Network controls that restrict broker and controller reachability, complementing protocol-level security. section 9.2.3 section 9.3.6
Figure 9.10 Overview of the security features supported in Kafka
Use the security overview to map authentication, authorization, and encryption controls across Kafka components and communication paths. section 9.3.1
Customer 360 security plan
A Customer 360 deployment uses mTLS between clients and brokers for authentication and encryption, while segmented internal networks carry broker, controller, and replication traffic through SASL_PLAINTEXT. ACLs govern Kafka Connect and Schema Registry access. This reduces internal encryption overhead but accepts risk that depends on strict network controls and monitoring. section 9.3.6 section 9.2.3
