Troubleshoot ACL Issues

This page covers common ACL issues and their solutions in Confluent Cloud.

Common ACL issues and solutions in Confluent Cloud:

Access denied errors

  • Verify the principal has the correct ACLs for the required operations

  • Check that ACLs are not being overridden by DENY rules

  • Ensure the resource name and pattern type match exactly

  • Verify that RBAC role bindings are not conflicting with ACL permissions

Consumer group ACLs

  • Remember that consumer group ACLs are separate from topic ACLs

  • Both READ permission on the topic and READ permission on the consumer group are required

  • Use the same principal for both topic and consumer group ACLs

ACL inheritance

  • Understand that ACLs are not inherited across different resource types

  • Each resource type (topic, consumer group, cluster) requires separate ACLs

  • Cluster-level permissions do not automatically grant topic-level permissions

RBAC and ACL interactions

  • Check if RBAC role bindings are providing the required permissions

  • Remember that ACL DENY rules take precedence over RBAC ALLOW rules

  • Verify that the principal has both appropriate RBAC roles and ACLs if needed

Service account ACLs

  • Ensure service accounts have the correct ACLs for their intended operations

  • Remember that service account ACLs are specific to Kafka clusters

  • API keys for other services (Schema Registry, ksqlDB) require separate permissions

Related content