ApsaraMQ for Kafka:Install and use Confluent CLI

Step 1: Download the binary

Download the Confluent CLI binary for your operating system from the Confluent CLI install page, or use a direct link from the following table:

To verify file integrity, download the checksums file.

Step 2: Add the CLI to your PATH

Set the PATH environment variable to include the directory that contains the extracted binary:

export PATH=<path-to-cli>:$PATH

Replace <path-to-cli> with the absolute path to the directory where you extracted the Confluent CLI binary.

Step 3 (optional): Change the data directory

By default, the Confluent CLI stores logs and data in a local directory. If this directory does not have enough storage space, set the CONFLUENT_CURRENT environment variable to a different location:

export CONFLUENT_CURRENT=<path-to-confluent-local-data>

Step 4: Verify the installation

Run the following command:

confluent

If the installation is successful, information similar to the following is returned:

Manage your Confluent Platform.

Usage:
  confluent [command]

Available Commands:
  audit-log            Manage audit log configuration.
  cloud-signup         Sign up for Confluent Cloud.
  cluster              Retrieve metadata about Confluent Platform clusters.
  completion           Print shell completion code.
  configuration        Configure the Confluent CLI.
  connect              Manage Kafka Connect.
  context              Manage CLI configuration contexts.
  flink                Manage Apache Flink.
  help                 Help about any command
  iam                  Manage RBAC, ACL and IAM permissions.
  kafka                Manage Apache Kafka.
  ksql                 Manage ksqlDB.
  local                Manage a local Confluent Platform development environment.
  login                Log in to Confluent Cloud or Confluent Platform.
  logout               Log out of Confluent Platform.
  plugin               Manage Confluent plugins.
  prompt               Add Confluent CLI context to your terminal prompt.
  schema-registry      Manage Schema Registry.
  secret               Manage secrets for Confluent Platform.
  shell                Start an interactive shell.
  update               Update the Confluent CLI.
  version              Show version of the Confluent CLI.

Flags:
      --version         Show version of the Confluent CLI.
  -h, --help            Show help for this command.
      --unsafe-trace    Equivalent to -vvvv, but also log HTTP requests and responses which might contain plaintext secrets.
  -v, --verbose count   Increase verbosity (-v for warn, -vv for info, -vvv for debug, -vvvv for trace).

Use "confluent [command] --help" for more information about a command.

List Identity and Access Management (IAM) roles

List all available IAM roles. IAM roles define the access permissions of users and services to resources based on RBAC.

confluent iam rbac role list

Describe an IAM role

View the details of a specific IAM role:

confluent iam rbac role describe <role-name>

Flags

Create a role binding

Bind an IAM role to a user or service principal:

confluent iam rbac role-binding create [flags]

Required flags

Scope flags

Other flags

Examples

Grant DeveloperRead on all Schema Registry subjects to user sr-read:

confluent iam rbac role-binding create \
  --principal User:sr-read \
  --role DeveloperRead \
  --resource Subject:* \
  --kafka-cluster <kafka-cluster-id> \
  --schema-registry-cluster <schema-registry-cluster-id>

Grant SystemAdmin on the Schema Registry cluster to user sr-admin:

confluent iam rbac role-binding create \
  --principal User:sr-admin \
  --role SystemAdmin \
  --kafka-cluster <kafka-cluster-id> \
  --schema-registry-cluster <schema-registry-cluster-id>

List role bindings

View existing role bindings:

confluent iam rbac role-binding list [flags]

Key flags

Examples

List all users with DeveloperRead on a Schema Registry cluster:

confluent iam rbac role-binding list \
  --role DeveloperRead \
  --kafka-cluster <kafka-cluster-id> \
  --schema-registry-cluster <schema-registry-cluster-id>

List all users with SystemAdmin on a Schema Registry cluster:

confluent iam rbac role-binding list \
  --role SystemAdmin \
  --kafka-cluster <kafka-cluster-id> \
  --schema-registry-cluster <schema-registry-cluster-id>

Delete a role binding

Remove an IAM role from a user:

confluent iam rbac role-binding delete [flags]

This command uses the same flags as role-binding create, plus:

Examples

Remove DeveloperRead from user sr-read on a Schema Registry cluster:

confluent iam rbac role-binding delete \
  --principal User:sr-read \
  --role DeveloperRead \
  --resource Subject:* \
  --kafka-cluster <kafka-cluster-id> \
  --schema-registry-cluster <schema-registry-cluster-id>

Remove SystemAdmin from user sr-admin on a Schema Registry cluster:

confluent iam rbac role-binding delete \
  --principal User:sr-admin \
  --role SystemAdmin \
  --kafka-cluster <kafka-cluster-id> \
  --schema-registry-cluster <schema-registry-cluster-id>

Create an ACL

confluent iam acl create [flags]

Required flags

Optional flags

Examples

Allow user Bob at IP address 198.51.xx.xx to read from test-topic:

confluent iam acl create \
  --allow \
  --principal User:Bob \
  --operation READ \
  --host 198.51.xx.xx \
  --topic test-topic \
  --kafka-cluster <kafka-cluster-id>

Allow all users to read from test-topic, but deny user BadBob:

# Allow all users
confluent iam acl create \
  --allow \
  --principal User:'*' \
  --operation READ \
  --topic test-topic \
  --kafka-cluster <kafka-cluster-id>

# Deny BadBob (--deny takes precedence over --allow)
confluent iam acl create \
  --deny \
  --principal User:BadBob \
  --operation READ \
  --topic test-topic \
  --kafka-cluster <kafka-cluster-id>

List ACLs

confluent iam acl list [flags]

The list command accepts the same filtering flags as create (such as --principal, --operation, --topic), plus:

Example

List all ACLs for a Kafka cluster:

confluent iam acl list --kafka-cluster <kafka-cluster-id>

Delete an ACL

confluent iam acl delete [flags]

Required flags

The delete command also accepts the same optional flags as create (such as --topic, --consumer-group, --prefix), plus:

Example

Delete the ACL that allows user Bob to read from test-topic:

confluent iam acl delete \
  --allow \
  --principal User:Bob \
  --operation READ \
  --host 198.51.xx.xx \
  --topic test-topic \
  --kafka-cluster <kafka-cluster-id>