ApsaraMQ for Kafka:Use ACL for access control

Usage notes

• For Internet or VPC instances, Kafka provides a default SASL user with read and write permissions for all topics and groups. To achieve fine-grained permission control, enable ACLs, create custom SASL users, and grant them permissions to send and receive messages from Message Queue for Apache Kafka as needed. After you enable ACLs, the default SASL user's permissions become invalid.

• After you enable ACL, sending messages no longer automatically creates topics.

Prerequisites

Your Message Queue for Apache Kafka instance must meet the following requirements:

• The instance is a Professional or Serverless Edition.

• The instance is in the Running status.

• The major version is 2.2.0 or later. For more information about how to upgrade the major version, see Upgrade versions.

• The minor version is the latest. For more information about how to upgrade the minor version, see Upgrade instance version.

Step 1: Enable ACL

After upgrading the minor version, enable ACL for the instance in the Message Queue for Apache Kafka console.

1. Log on to the ApsaraMQ for Kafka console.

2. In the Resource Distribution section of the Overview page, select the region where the ApsaraMQ for Kafka instance that you want to manage resides.

3. On the Instances page, click the name of the instance that you want to manage.

4. On the Instance Details page, click Enable ACL in the upper-right corner of the Overview section.

5. In the Note dialog box, click OK and then manually refresh the page.

   After you refresh the page, the Status in the Basic Information section of the Instance Details page changes to Upgrading. The process is complete when the Status changes to Running.

   Important

   ACL is enabled only after the upgrade is complete. You can then create SASL users, grant them permissions, and connect to the instance by using a SASL endpoint. The upgrade takes approximately 15 to 20 minutes.

Step 2: Create a SASL user

After enabling ACL for the instance, create a SASL user for User A.

1. Log on to the ApsaraMQ for Kafka console.

2. In the Resource Distribution section of the Overview page, select the region where the ApsaraMQ for Kafka instance that you want to manage resides.

3. On the Instances page, select the instance for which you have enabled ACL.

4. On the Instance Details page, click the Manage SASL Users tab. For a Serverless Edition instance, choose Permissions > Manage SASL Users in the left-side navigation pane.

5. On the Manage SASL Users page, click Create SASL User.

6. In the Create SASL User panel, configure the parameters for the SASL user and click OK.

   Parameter	Description
   Username	The name of the SASL user.
   User Type	Message Queue for Apache Kafka supports the following SASL mechanisms: PLAIN: A simple username and password verification mechanism. Message Queue for Apache Kafka optimizes the PLAIN mechanism to support the dynamic creation of SASL users without restarting the instance. SCRAM: A username and password authentication mechanism that is more secure than PLAIN. For Message Queue for Apache Kafka, non-Serverless instances use SCRAM-SHA-256. Serverless instances support SCRAM-SHA-512, and it is the default configuration for SCRAM.
   Password	The password for the SASL user.
   Confirm Password	Enter the password again to confirm it.

   After the user is created, it appears on the Manage SASL Users tab.

   • To change the password for the SASL user, click Change Password in the Actions column. In the Change SASL User Password panel, set a New Password and Confirm Password, and then click OK.

   • To delete the SASL user, click Delete in the Actions column.

Step 3: Grant permissions to the SASL user

After creating the SASL user for User A, grant the user permissions to read messages from topics and consumer groups.

1. On the Instance Details page, click the Manage SASL User Permissions tab.

2. On the Manage SASL User Permissions tab, click Grant Permission.

3. In the Grant Permission panel, configure the following parameters and click OK.

   Parameter	Description
   Username	The name of the SASL user. The asterisk (*) wildcard represents all usernames.
   Resource Type	Message Queue for Apache Kafka supports authorization for the following resource types: Topic: A message topic. Group: A consumer group. Cluster: An instance. Transactional ID: A transactional ID.
   Match Mode	Message Queue for Apache Kafka supports the following match modes: Exact Match: Matches only resources whose names are identical to the resource name you enter. Prefix Match: Matches any resource whose name starts with the prefix you enter.
   Resource Name	The name of the topic, group, or cluster, or the transactional ID. The asterisk (*) wildcard represents all resource names.
   Operation Type	Message Queue for Apache Kafka supports the following operation types: Write Read Idempotent Write Operation Important For the Group resource type, only the Read operation is supported. For the cluster resource type, only the Idempotent Write Operation operation is supported.

   For Serverless Edition instances

   Parameter	Description
   Username	The name of the SASL user. The asterisk (*) wildcard represents all usernames.
   Resource Type	Message Queue for Apache Kafka supports authorization for the following resource types: Topic: A message topic. Group: A consumer group. Cluster: An instance. Transactional ID: A transactional ID.
   Match Mode	Message Queue for Apache Kafka supports the following match modes: Exact Match: Matches only resources whose names are identical to the resource name you enter. Prefix Match: Matches any resource whose name starts with the prefix you enter.
   Resource Name	The name of the topic, group, or cluster, or the transactional ID. The asterisk (*) wildcard represents all resource names.
   Source IP Address	Restricts access to specific IP addresses or IP address ranges.
   Authorization Method	ALLOW: Allows access. DENY: Denies access.
   Operation Type	Message Queue for Apache Kafka supports the following operation types: WRITE: Write READ: Read CREATE: Create DELETE: Delete DESCRIBE: View metadata and offset information. DESCRIBE_CONFIGS: View configuration information. IDEMPOTENT_WRITE: Idempotent write. Important For clients of version 3.0 or later, idempotent writes are enabled by default. To send messages successfully, you must set enable.idempotence=true and grant the IDEMPOTENT_WRITE permission. When you grant WRITE, READ, DELETE, or ALTER permissions, the DESCRIBE permission is granted by default. For the cluster resource type, only the IDEMPOTENT_WRITE operation is supported.

   After the configuration is complete, you can view the created user permissions on the Manage SASL User Permissions tab. You can filter the permissions by Resource Type, Match Mode, Resource Name, and Username, and then click Search.

Related operations

• After the permissions are granted, User A can connect to the Message Queue for Apache Kafka instance by using a SASL endpoint and consume messages with an SDK. To learn how to connect with an SDK, see SDK overview.

• To grant permissions to a SASL user by using API operations, see Create SASL User and Create ACL.

• For more information about SASL endpoints, see Endpoint comparison.