How is access rights restriction implemented in Kafka cluster? What entities do ACLs apply to?

Access control in Apache Kafka is implemented through the ACL (Access Control Lists) mechanism. ACLs allow specifying which users or services (principals) have permissions to perform certain operations on cluster resources.

ACLs apply to the following main entities:

• Topic — permissions for reading (READ), writing (WRITE), creating (CREATE), deleting (DELETE) topics.
• Group — permissions to manage consumer groups (e.g., reading offsets).
• Cluster — permissions related to the cluster itself, such as creating topics, managing ACLs.
• TransactionalId — permissions to use transactions.

Each ACL defines:

• The principal (user or service account) granted permissions.
• The resource (topic, group, cluster, etc.).
• Allowed operations (READ, WRITE, DESCRIBE, CREATE, DELETE, etc.).
• The permission type (ALLOW or DENY).

Example command to add an ACL:

kafka-acls --authorizer-properties zookeeper.connect=localhost:2181 \
  --add --allow-principal User:Alice --operation Read --topic my-topic

Thus, ACLs in Kafka enable flexible management of access at key cluster resource levels.