ACL Operations¶
This page covers the operational aspects of working with ACLs in Confluent Cloud, including resource types, operations, and implementation details.
ACL resources and operations for Confluent Cloud (summary)¶
The ACL resources and operations listed below are available in Confluent Cloud for controlling access to Kafka resources. Each operation can be granted with ALLOW or DENY permissions.
| Resource | Operation |
|---|---|
| Cluster | CREATE (allows creating topics)
DESCRIBE: DescribeConfigs, DescribeCluster, other meta-data
IDEMPOTENT_WRITE: for producers in Idempotent mode, InitProducerId(idempotent): To initialize the producer
ALTER (CreateAcls, DeleteAcls)
|
| Consumer Groups | DELETE
DESCRIBE
READ
|
| Topic | ALTER
ALTER_CONFIGS
CREATE
DELETE
DESCRIBE (for example, number of partitions)
DESCRIBE_CONFIGS
READ
WRITE
|
| TransactionalID | DESCRIBE
WRITE
|
Note
All operations listed above support both ALLOW and DENY permissions. DENY permissions take precedence over ALLOW permissions and RBAC role bindings.
ACL operation details¶
Create ACL¶
Supports both Resource ID (resourceId) and the Integer ID (userIntegerId)
as principal.
Example:
- Resource ID (
resourceId):User:sa-1234 - Integer ID (
userIntegerId):User:1234
Describe ACL¶
When describing ACLs, the principal format you use affects which ACLs are returned:
| Principal format used | ACLs returned for | Return format |
|---|---|---|
Integer ID: User:1234 |
Both Integer and Resource ID formats | Integer ID format |
Resource ID: User:sa-1234 |
Both Integer and Resource ID formats | Resource ID format |
| None (list all) | All ACLs | Integer ID format |
Resource ID: UserV2:* |
All ACLs | Resource ID format |
Delete ACL¶
When deleting ACLs, the principal format you use affects which ACLs are deleted:
| Principal format used | ACLs deleted for | Return format |
|---|---|---|
Integer ID: User:1234 |
Both Integer and Resource ID formats | Integer ID format |
Resource ID: User:sa-1234 |
Both Integer and Resource ID formats | Resource ID format |
| None (delete all) | All ACLs | Integer ID format |
Resource ID: UserV2:* |
All ACLs | Resource ID format |
Important
If you delete a user, and have ACLs created using both formats (Integer ID and Resource ID), then you must delete ACLs for both the Integer ID and Resource ID formats.
Cluster linking¶
If you use cluster linking to replicate data between two Confluent Cloud Kafka clusters, the same principal must be used for both clusters, but your ACLs can include either the Resource ID or Integer ID to specify your resources.
For example, if you are using cluster linking to migrate data between two Confluent Cloud clusters, you could have ACLs that use the deprecated Integer ID format on the source cluster and the Resource ID format for ACLs on the destination cluster.
For details, see ACL syncing. For more information about cluster linking security considerations, see Manage Security for Cluster Linking on Confluent Cloud.