# ACL Examples and Use Cases This page provides practical examples and use cases for implementing ACLs in Confluent Cloud. ## ACL examples The following examples demonstrate common ACL patterns for different use cases in Confluent Cloud: ### Producer access to specific topics Grant a service account permission to produce messages to specific topics: ```shell confluent kafka acl create --allow --service-account sa-1234 \ --operations write --topic my-topic ``` ### Consumer access to topics and consumer groups Grant a service account permission to consume from topics and use consumer groups: ```shell # Grant read access to the topic confluent kafka acl create --allow --service-account sa-1234 \ --operations read --topic my-topic # Grant read access to the consumer group confluent kafka acl create --allow --service-account sa-1234 \ --operations read --consumer-group my-consumer-group ``` ### Topic creation permissions Grant a service account permission to create topics: ```shell confluent kafka acl create --allow --service-account sa-1234 \ --operations create --topic "*" ``` ### Prefix-based access control Grant access to all topics with a specific prefix: ```shell confluent kafka acl create --allow --service-account sa-1234 \ --operations read,write --topic "prod-" --prefix ``` ### DENY ACL for security Explicitly deny access to sensitive topics: ```shell confluent kafka acl create --deny --service-account sa-1234 \ --operations read,write --topic sensitive-data ``` ### Cluster-level permissions Grant cluster management permissions: ```shell confluent kafka acl create --allow --service-account sa-1234 \ --operations describe --cluster ``` ## ACL use cases ### Multi-tenant environments Use ACLs to isolate different teams or applications within the same cluster. For more information about multi-tenancy and client quotas, see [Multi-Tenancy and Client Quotas on Confluent Cloud](../../../clusters/client-quotas.md#client-quotas). ```shell # Team A access confluent kafka acl create --allow --service-account team-a \ --operations read,write --topic "team-a-" --prefix # Team B access confluent kafka acl create --allow --service-account team-b \ --operations read,write --topic "team-b-" --prefix ``` ### Data pipeline security Secure data pipelines by granting specific permissions to each component: ```shell # Source connector permissions confluent kafka acl create --allow --service-account source-connector \ --operations write --topic "raw-data" # Processing application permissions confluent kafka acl create --allow --service-account processor \ --operations read --topic "raw-data" confluent kafka acl create --allow --service-account processor \ --operations write --topic "processed-data" # Sink connector permissions confluent kafka acl create --allow --service-account sink-connector \ --operations read --topic "processed-data" ``` ### Compliance and audit requirements Implement strict access controls for compliance: ```shell # Grant minimal required permissions confluent kafka acl create --allow --service-account compliance-app \ --operations read --topic "audit-logs" # Deny access to sensitive topics confluent kafka acl create --deny --service-account compliance-app \ --operations read,write --topic "pii-data" ``` ## Related content - [ACL Overview](overview.md#acl-overview) - ACL concepts and best practices - [ACL Operations](operations.md#acl-operations) - ACL operations and implementation details - [Troubleshoot ACL Issues](troubleshooting.md#acl-troubleshooting) - Troubleshooting ACL issues - [ACL Reference](reference.md#acl-reference) - ACL reference information