Grant a Principal Access to a Topic

Grant a Principal Access to a Topic

Create and verify a topic READ ACL for a principal.

1. Resolve the cluster id so the ACL is written against the cluster the proxy is actually fronting.
2. Confirm the topic exists before writing an ACL against its name. Kafka accepts ACLs for topic names that do not exist, so a typo here would silently produce a grant that never takes effect.
3. Audit the ACLs already bound to topic resources on this cluster, so the new grant is added with full knowledge of what access exists today.
4. Create the ACL binding the principal to the topic for the requested operation.
5. Re-read the topic ACLs and confirm the grant is present, so the authorization change is proven by the cluster rather than assumed from a 201.

What you'll need to have ready

• topicName: The topic the principal is being granted access to.
• principal: The Kafka principal receiving the grant, in principal-type:name form (e.g. User:analytics-consumer).
• host: The host the grant applies to. An asterisk allows the principal to connect from any host.
• operation: The operation being granted (e.g. READ, WRITE, DESCRIBE).
• permission: Whether the ACL allows or denies the operation.
• patternType: How the resource name is matched. LITERAL binds the ACL to exactly this topic; PREFIXED would bind it to every topic sharing the prefix.

For your developer

Arazzo workflow apache-kafka:grant-topic-access, 5 operations: listClusters → getTopic → searchAcls → createAcls → searchAcls. Specs on APIs.io.