Message Queue for Apache Kafka Professional Edition and Serverless Edition instances support the access control list (ACL) feature. After you enable ACL, you can grant SASL users fine-grained permissions and route all data-plane access through a SASL endpoint.
Description
ACL provides fine-grained permission control at the topic and Consumer Group level. After you enable ACL, you can grant SASL users permissions to produce to or consume from specific topics, or to use specific Consumer Groups. All data-plane access goes through the SASL endpoint.
Difference between ACL and network-layer allowlists (security groups)
ACL and network-layer allowlists (security groups) are both security mechanisms, but they operate at different layers:
|
Security mechanism |
Layer |
Control granularity |
|
Network-layer allowlist (security group) |
Network |
Controls which IP addresses can connect to the instance. Does not differentiate between users or resources. |
|
ACL |
Data plane |
Controls which SASL users have read or write access to specific topics or Consumer Groups, enabling fine-grained access control and sensitive data protection. |
(Recommended) Use both mechanisms together for layered security.
ApsaraMQ for Kafka security ecosystem
ApsaraMQ for Kafka provides a comprehensive security framework:
|
Component |
Purpose |
|
RAM permission management |
Controls console and API access for Alibaba Cloud accounts and RAM users. |
|
ACL + SASL authentication |
Provides resource-level access control (ACL) and identity authentication (SASL) at the data plane. |
|
SSL/TLS encryption in transit |
Encrypts data in transit to prevent interception. |
|
Cloud Monitor |
Provides monitoring and audit capabilities. |
ACL is the key component for fine-grained data access control and sensitive data protection, such as restricting who can produce to or consume from specific topics or Consumer Groups.
Prerequisites
-
The instance is a Professional Edition or Serverless Edition.
-
The instance status is Running.
-
The major version of the instance is 2.2.0 or later. For upgrade instructions, see Upgrade versions.
-
The instance's minor version is the latest. For upgrade instructions, see Upgrade instance versions.
Procedure
Log on to the ApsaraMQ for Kafka console.
In the Resource Distribution section of the Overview page, select the region where the ApsaraMQ for Kafka instance that you want to manage resides.
On the Instances page, click the name of the instance that you want to manage.
-
On the Instance Details page, click Enable ACL in the upper-right corner of the Overview section.
-
In the ACL Risk Notice dialog box, click OK, and then manually refresh the page.
After you manually refresh the page, the instance's Status changes to Upgrading in the Basic Information section of the Instance Details page. The process is complete when the Status returns to Running.
Note-
Enabling ACL requires an instance upgrade that takes about 30 minutes (longer for larger clusters). After the upgrade, you can create SASL users and grant them permissions to access the instance via a SASL endpoint. For more information, see Create a SASL user.
-
You can also enable the ACL feature when you create an instance.
-
FAQ
Q: How do I resolve GroupAuthorizationException errors when consumers connect?
This error typically occurs because the Consumer Group has not been granted read permission in the ACL configuration.
Cause: When ACL is enabled, consumer connections that read from a Consumer Group require explicit read permission on the Group resource. Without this permission, the broker rejects the connection and returns GroupAuthorizationException.
Solution:
-
Verify that ACL is enabled for your instance.
-
On the instance details page, click the Manage SASL User Permissions tab.
-
Click Grant Permission.
-
In the Grant Permission panel, configure the following settings:
-
Set Resource Type to Group.
-
Set Operation Type to Read.
-
Specify the Consumer Group name, or enter a prefix and select Prefix Match for the match mode.
-
Select the SASL username that the consumer application uses.
-
-
Submit the ACL rule. The consumer can then connect successfully.
Standard Edition instances do not support ACL. If your instance is Standard Edition, grant the RAM user the AliyunKafkaFullAccess permission as an alternative access control method.