Alibaba Cloud offers Resource Access Management (RAM), which allows you to manage permissions for the Message Queue for Apache Kafka console and API. RAM allows you to avoid sharing the AccessKey pair, which includes an AccessKey ID and an AccessKey secret, of your Alibaba Cloud account with other users. Instead, you can grant users only the minimum required permissions.

RAM policies

In RAM, policies are a set of permissions that are described based on the policy structure and syntax. You can use policies to describe the authorized resource sets, authorized operation sets, and authorization conditions. For more information, see Policy structure and syntax.

In RAM, a policy is a resource entity. Message Queue for Apache Kafka supports the following types of policies:

  • System policies: System policies are created and updated by Alibaba Cloud and you cannot modify them. These policies are applicable to coarse-grained control of RAM user permissions.
  • Custom policies: You can create, update, and delete custom policies and maintain policy versions. These policies are applicable to fine-grained control of RAM user permissions.

System policies

The following table lists the system policies supported by Message Queue for Apache Kafka.

Policy Description
AliyunKafkaFullAccess The management permission of Message Queue for Apache Kafka. The RAM user who has been granted this permission has the permission equivalent to the Alibaba Cloud account, that is, all operation permissions of the console and API.
AliyunKafkaReadOnlyAccess The read-only permission of Message Queue for Apache Kafka. The RAM user who has been granted this permission has only the read-only permission of all resources of the Alibaba Cloud account, and does not have the operation permissions of the console and API.

Examples of system policies

Use the system policy AliyunKafkaFullAccess as an example. The RAM user who has been granted this permission has the permission equivalent to the Alibaba Cloud account, that is, all operation permissions of the console and API. The following code displays the policy content: 

{
    "Version": "1",
    "Statement": [
        {
            "Action": "alikafka:*",
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Custom policies

The following table lists the custom policies supported by Message Queue for Apache Kafka.

Action Permission description Read-only or not
ReadOnly Only reads all resources. Yes
ListInstance Views instances. Yes
StartInstance Deploys instances. No
UpdateInstance Changes instance configuration. No
ReleaseInstance Releases instances. No
ListTopic Views topics. Yes
CreateTopic Creates topics. No
UpdateTopic Changes topic configuration. No
DeleteTopic Deletes topics. No
ListGroup Views consumer groups. Yes
CreateGroup Creates consumer groups. No
UpdateGroup Changes consumer group configuration. No
DeleteGroup Deletes consumer groups. No
QueryMessage Queries messages. Yes
SendMessage Sends messages. No
DownloadMessage Downloads messages. Yes
CreateDeployment Creates connector tasks. No
DeleteDeployment Deletes connector tasks. No
ListDeployments Views connector tasks. Yes
UpdateDeploymentRemark Updates connector task description. No
GetDeploymentLog Obtains the operational logs of connector tasks. Yes
EnableAcl Enables the access control list (ACL) feature. No
CreateAcl Creates an ACL. No
DeleteAcl Deletes an ACL. No
ListAcl Queries ACLs. Yes
CreateSaslUser Creates a Simple Authentication and Security Layer (SASL) user. No
DeleteSaslUser Deletes an SASL user. No
ListSaslUser Queries SASL users. Yes

Examples of custom policies

Use the custom policy AliyunKafkaCustomAccess as an example. The RAM user who has been granted this permission only has the permissions to view the alikafka_post-cn-xxx instance, view topics, view consumer groups, query messages, and download messages in the console and by using API operations. The following code displays the policy content: 

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
              "alikafka:ListInstance",
              "alikafka:ListTopic",
              "alikafka:ListGroup",
              "alikafka:QueryMessage",
              "alikafka:DownloadMessage"
                       ],
            "Resource": "acs:alikafka:*:*:alikafka_post-cn-xxx",
            "Effect": "Allow"
        }
    ]
}