<a id="acl-operations"></a>

# ACL Operations

This page covers the operational aspects of working with ACLs in Confluent Cloud,
including resource types, operations, and implementation details.

<a id="cloud-acl-resources-and-operations"></a>

## ACL resources and operations for Confluent Cloud

The ACL resources and operations listed below are available in Confluent Cloud for
controlling access to Kafka resources. Each operation can be granted with
ALLOW or DENY permissions.

| Resource        | Operation                                                                                                                                                                                                                                                                                    |
|-----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Cluster         | CREATE (allows creating topics)<br/><br/><br/>DESCRIBE: DescribeConfigs, DescribeCluster, other meta-data<br/><br/><br/>IDEMPOTENT_WRITE: for producers in Idempotent mode, initialize the producer with `InitProducerId(idempotent)`<br/><br/><br/>ALTER (CreateAcls, DeleteAcls)<br/><br/> |
| Consumer Groups | DELETE<br/><br/><br/>DESCRIBE<br/><br/><br/>READ<br/><br/>                                                                                                                                                                                                                                   |
| Topic           | ALTER<br/><br/><br/>ALTER_CONFIGS<br/><br/><br/>CREATE<br/><br/><br/>DELETE<br/><br/><br/>DESCRIBE (for example, number of partitions)<br/><br/><br/>DESCRIBE_CONFIGS<br/><br/><br/>READ<br/><br/><br/>WRITE<br/><br/>                                                                       |
| TransactionalID | DESCRIBE<br/><br/><br/>WRITE<br/><br/>                                                                                                                                                                                                                                                       |

#### NOTE
All operations listed above support both ALLOW and DENY permissions.
DENY permissions take precedence over ALLOW permissions and RBAC role bindings.

<a id="acl-operation-details"></a>

## ACL operation details

### Create ACL

Supports both Resource ID (`resourceId`) and the Integer ID (`userIntegerId`)
as principal.

Example:

- Resource ID (`resourceId`): `User:sa-1234`
- Integer ID (`userIntegerId`): `User:1234`

#### Create an ACL with Terraform

Create an ACL by using the Confluent Terraform provider. For more
information, see [confluent_kafka_acl Resource](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_kafka_acl).

### Describe ACL

When describing ACLs, the principal format you use affects which ACLs are returned:

| Principal format used       | ACLs returned for                    | Return format      |
|-----------------------------|--------------------------------------|--------------------|
| Integer ID: `User:1234`     | Both Integer and Resource ID formats | Integer ID format  |
| Resource ID: `User:sa-1234` | Both Integer and Resource ID formats | Resource ID format |
| None (list all)             | All ACLs                             | Integer ID format  |
| Resource ID: `UserV2:*`     | All ACLs                             | Resource ID format |

### Delete ACL

When deleting ACLs, the principal format you use affects which ACLs are deleted:

| Principal format used       | ACLs deleted for                     | Return format      |
|-----------------------------|--------------------------------------|--------------------|
| Integer ID: `User:1234`     | Both Integer and Resource ID formats | Integer ID format  |
| Resource ID: `User:sa-1234` | Both Integer and Resource ID formats | Resource ID format |
| None (delete all)           | All ACLs                             | Integer ID format  |
| Resource ID: `UserV2:*`     | All ACLs                             | Resource ID format |

#### IMPORTANT
If you delete a user, and have ACLs created using both formats
(Integer ID and Resource ID), then you must delete ACLs for both
the Integer ID and Resource ID formats.

### Cluster linking

If you use [cluster linking](../../../multi-cloud/cluster-linking/index.md#cloud-cluster-linking) to replicate
data between two Confluent Cloud Kafka clusters, the same [principal](../../../_glossary.md#term-principal) must be used
for both clusters, but your ACLs can include either
the Resource ID or Integer ID to specify your resources.

For example, if you are using cluster linking to migrate data between two Confluent Cloud
clusters, you could have ACLs that use the deprecated Integer ID format on the
source cluster and the Resource ID format for ACLs on the destination cluster.

For details, see [ACL syncing](../../../multi-cloud/cluster-linking/index.md#cluster-link-acl-sync-limits-cc). For more information about
cluster linking security considerations, see [Manage Security for Cluster Linking on Confluent Cloud](../../../multi-cloud/cluster-linking/security-cloud.md#cloud-cluster-link-security).

## Related content

- [ACL Overview](overview.md#acl-overview) - ACL concepts and best practices
- [ACL Examples and Use Cases](examples.md#acl-examples) - ACL examples and use cases
- [Troubleshoot ACL Issues](troubleshooting.md#acl-troubleshooting) - Troubleshooting ACL issues
- [ACL Reference](reference.md#acl-reference) - ACL reference information