Browse documentation

Get Started

Console

Topics

Schema Registry

Consumer Groups

Data Clone

Operate

Inspect Kafka ACLs and Simulate Access

Access Control lists the Kafka ACLs visible to Kafma and helps explain which rules affect a request. The page is read-only; manage ACLs with your cluster administration tools.

What is a Kafka ACL?

A Kafka access control list rule connects a principal and host to an operation on a resource. Its permission is either ALLOW or DENY.

A literal pattern normally matches one resource name; the literal name * matches every resource of that type. A prefixed pattern matches names that begin with the configured prefix. When both permissions match, DENY takes precedence.

Browse Kafka ACLs

Each row shows the principal, resource, operation, permission, and host. Search by principal or resource name, or filter by resource type, operation, and permission.

A host of * matches every client host, and User:* matches every user principal. An asterisk appended to a resource name marks a prefixed pattern.

Browsing and filtering Kafka ACLs in Kafma

Simulate access

Open ACL Simulator, enter a principal, then choose the operation, resource type, and resource name. Kafma evaluates the visible Kafka ACLs and highlights the rules that grant, block, or are overridden for that request.

The result can be:

  • Allowed — at least one matching ALLOW rule applies and no matching DENY rule overrides it.
  • Denied — an explicit matching DENY rule applies.
  • Indeterminate — no visible ACL decides the request, the result depends on the client IP, or Kafma cannot safely interpret a rule.

Simulating Kafka access and identifying the matching deny ACL

The simulator checks one resource at a time and does not know the client IP seen by the broker. It also cannot see super.users, allow.everyone.if.no.acl.found, provider-managed authorization, or custom authorizers. An Indeterminate result is not a denial.

Troubleshoot Kafka authorization failures

A Kafka operation can require access to more than one resource. For example, a consumer normally needs READ on both its topic and consumer group. Simulate each resource separately to find which permission is missing.

Start with the client's principal, the failed operation, and the affected resource. Refresh the ACL list before running the simulation if an administrator has just changed the rules.

Next steps