Kafka ACLs and Authorization

The reporting service has valid credentials and can connect to Kafka. It needs to read order events, but it should not publish orders, change retention, or delete the topic. Authentication identifies the service; authorization enforces those boundaries.

Kafka's access control lists, or ACLs, express which identities may perform which operations on Kafka resources. A useful policy gives each application enough access to do its job while keeping unrelated operations out of reach.

This chapter explains how Kafka evaluates ACLs, builds a policy for an order producer and reporting consumer, and shows how to inspect and change that policy. Examples use Apache Kafka 4.3.1 in KRaft mode with the built-in StandardAuthorizer and authenticated TLS connections.