ACLs

Introduction

What is ACLs? ACLs authorize principals to read, write, create, describe, alter, or administer Kafka resources.

Understanding the topic

What happens — ACLs:

• Enable TLS for encrypted transport.
• Authenticate clients with SASL or mTLS.
• Authorize with ACLs per topic/group.
• Rotate secrets via vault or K8s.

Visual explanation

Pipeline view:

Client identity
  ↓
TLS/SASL authentication
  ↓
ACL authorization
  ↓
topic operation
  ↓
audit log

Step-by-step explanation

1. Encrypt — TLS on listeners.
2. Authenticate — SASL or certificates.
3. Authorize — kafka-acls grants.
4. Audit — Log access attempts.

Informative example

Example:

kafka-topics --bootstrap-server localhost:9092 --create --topic acls --partitions 6 --replication-factor 3
kafka-console-producer --bootstrap-server localhost:9092 --topic acls
kafka-console-consumer --bootstrap-server localhost:9092 --topic acls --from-beginning
kafka-consumer-groups --bootstrap-server localhost:9092 --describe --group acls-service

Execution workflow

Best practices

• Use least-privilege ACLs.
• Separate producer and consumer principals.
• Rotate credentials and avoid plaintext secrets.
• Audit access to sensitive topics.

Common mistakes

• Using wildcard ACLs in production.
• Committing JAAS configs or passwords.
• Assuming encryption solves authorization.

Summary

ACLs — Apply least privilege per service, per topic, per operation; rotate secrets and audit access.