ACLs

The ACLs tab lists all access control rules that define which principals can perform specific operations on cluster resources.

Overview

Each rule lists the principal it applies to, the host it's scoped to, the operation and permission (Allow or Deny), and the resource type, name, and pattern the rule matches.

Add an ACL Rule

Select Add ACL rule and configure:

• Principal: the user or group the rule applies to, in User:name or Group:name format (for example, User:alice).
• Host: the host the rule applies from, or * to allow from any host.
• Operation: the Kafka operation being controlled (see Permission Types below).
• Permission: Allow or Deny.
• Resource Type: Topic, Consumer Group, or Cluster.
• Resource Name: the specific resource the rule covers, for example orders.events.v1.
• Pattern Type: Literal (exact match) or a prefix match, for rules that should apply to a family of resource names such as orders.*.

Add ACL Rule dialog with principal, host, operation, permission, and resource fields

Permission Types

Permission	Description
Read	Consume messages from a topic or fetch offsets for a group.
Write	Produce messages to a topic.
Create	Create new topics or partitions.
Delete	Delete topics or records.
Alter	Modify topic configurations or reassign partitions.
Describe	View topic metadata, group offsets, and cluster information.

Auditing Access

Use this view to:

• Verify that API Product consumers only have Read access to their subscribed topics.
• Confirm that producers are restricted to Write on their designated topics.
• Identify overly permissive principals with cluster-wide * resource rules.
• Detect missing ACLs that could prevent Gateway connections from functioning.

Tips

The Gateway uses a dedicated service principal. Confirm it has Read, Write, and Describe permissions on topics backing your API Products.