Advanced Spring Boot 4: Event-Driven Architecture (Kafka) · 강의

ACL을 활용한 권한 부여

Kafka 브로커에 액세스 제어 목록(ACL)을 구현하여 프로듀서와 컨슈머에 세분화된 권한을 정의합니다.

ACL을 활용한 권한 부여은(는) CoddyKit의 무료 Advanced Spring Boot 4: Event-Driven Architecture (Kafka) 강의입니다. 이것은 4개 중 2번째 강의입니다. 아래에서 전체 강의를 무료로 읽을 수 있으며, 내장 코드 에디터와 24/7 AI 튜터와 함께 브라우저에서 직접 실습할 수 있습니다. 이 강의는 Advanced Spring Boot 4: Event-Driven Architecture (Kafka) 학습 경로의 일부이며, 진행 상황이 웹과 CoddyKit 앱에 동기화됩니다. Advanced Spring Boot 4: Event-Driven Architecture (Kafka) 강의에는 총 4개의 강의가 포함되어 있습니다.

이 강의의 일부는 아직 번역되지 않았으며 영어로 표시됩니다.

What are Kafka ACLs?

In our last lesson, we learned about authenticating with Kafka using SASL. But authentication just verifies who you are.

Authorization determines what you are allowed to do. This is where Access Control Lists (ACLs) come in.

Kafka ACLs provide fine-grained permissions, letting you control which users (or principals) can perform specific actions on Kafka resources.

The Core of Kafka Authorization

Authorization in Kafka revolves around three key concepts:

Principal: The authenticated user or client attempting an action (e.g., User:Alice, User:ProducerApp).
Operation: The action being attempted (e.g., READ, WRITE, CREATE, DELETE).
Resource: The Kafka entity the operation is performed on (e.g., a specific topic, a consumer group).

ACLs define which principals can perform which operations on which resources.

Different Types of Kafka Resources

Kafka allows you to set permissions on several types of resources:

Topic: For producing messages to or consuming from specific topics.
Group: For managing consumer group memberships and offset commits.
Cluster: For cluster-wide operations like describing brokers or creating topics.
TransactionalId: For using Kafka transactions.
DelegationToken: For managing delegation tokens (advanced).

Most common are Topic, Group, and Cluster resources.

ACL Syntax with `kafka-acls.sh`

ACLs are typically managed using the kafka-acls.sh command-line tool. You'll specify the principal, operation, and resource.

Here's a basic structure:

kafka-acls.sh --authorizer-properties ... \
--add --allow-principal 'User:Alice' \
--operation Read --topic 'my-topic'

This grants User:Alice permission to Read from my-topic.

ACLs for a Kafka Producer

A Kafka producer needs permissions to:

Write messages: To a specific topic.
Describe the cluster: To discover broker metadata.

Example commands to grant these permissions for a producer named User:ProducerApp on topic orders:

kafka-acls.sh --add --allow-principal 'User:ProducerApp' --operation Write --topic 'orders' --authorizer-properties ...

kafka-acls.sh --add --allow-principal 'User:ProducerApp' --operation Describe --cluster --authorizer-properties ...

Spring Producer & ACLs

This Spring Boot producer sends a message to my-secured-topic. For it to work, the principal associated with this application (e.g., User:my-producer via SASL) must have the necessary ACLs configured on the Kafka broker.

Specifically, it needs WRITE permission on the topic and DESCRIBE permission on the cluster resource.

import org.springframework.boot.CommandLineRunner;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.kafka.core.KafkaTemplate;
import org.springframework.context.annotation.Bean;

@SpringBootApplication
public class KafkaProducerAclApp {

    public static void main(String[] args) {
        SpringApplication.run(KafkaProducerAclApp.class, args);
    }

    @Bean
    public CommandLineRunner runner(KafkaTemplate<String, String> kafkaTemplate) {
        return args -> {
            String topic = "my-secured-topic";
            String message = "Hello from secured producer!";
            kafkaTemplate.send(topic, message);
            System.out.println("Sent message: '" + message + "' to topic: '" + topic + "'");
            System.out.println("Check Kafka broker logs for successful message receipt.");
        };
    }
}

ACLs for a Kafka Consumer

A Kafka consumer needs permissions to:

Read messages: From a specific topic.
Read from its consumer group: To manage offsets and join the group.
Describe the cluster: Like producers, for metadata.

Example commands for User:ConsumerApp on topic payments and group payment-processors:

kafka-acls.sh --add --allow-principal 'User:ConsumerApp' --operation Read --topic 'payments' --authorizer-properties ...

kafka-acls.sh --add --allow-principal 'User:ConsumerApp' --operation Read --group 'payment-processors' --authorizer-properties ...

kafka-acls.sh --add --allow-principal 'User:ConsumerApp' --operation Describe --cluster --authorizer-properties ...

Spring Consumer & ACLs

This Spring Boot consumer listens to my-secured-topic as part of my-secured-group. Its associated principal (e.g., User:my-consumer) needs specific ACLs.

It requires READ permission on the topic, READ permission on the consumer group, and DESCRIBE permission on the cluster resource.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.kafka.annotation.KafkaListener;

@SpringBootApplication
public class KafkaConsumerAclApp {

    public static void main(String[] args) {
        SpringApplication.run(KafkaConsumerAclApp.class, args);
    }

    @KafkaListener(topics = "my-secured-topic", groupId = "my-secured-group")
    public void listen(String message) {
        System.out.println("Received secured message: " + message);
    }
}

Listing & Revoking ACLs

It's important to manage ACLs effectively. You can list all ACLs or specific ones:

kafka-acls.sh --list --topic 'my-topic' --authorizer-properties ...

To remove an ACL, use the --remove flag instead of --add, specifying the exact ACL you wish to revoke:

kafka-acls.sh --remove --allow-principal 'User:Alice' --operation Read --topic 'my-topic' --authorizer-properties ...

Regularly review and remove unnecessary permissions for security best practices.

ACLs Quick Check

Which of the following permissions are typically required for a Kafka consumer to successfully read messages from a topic and join a consumer group?

Recap: Securing with ACLs

Great job! You've learned how Kafka's authorization works using Access Control Lists (ACLs).

ACLs define who (principal) can do what (operation) on where (resource).
Key resources include topics, consumer groups, and the cluster itself.
You use kafka-acls.sh to manage these permissions on the broker.
Spring Boot Kafka applications implicitly rely on these ACLs being in place for their authenticated principals.

Next, we'll explore how to encrypt data in transit using SSL/TLS.

자주 묻는 질문

“ACL을 활용한 권한 부여” 강의는 무료인가요?

네 — “ACL을 활용한 권한 부여” 전체 내용을 이 웹사이트에서 무료로 읽을 수 있습니다. 인터랙티브하게 실습하려면(내장 코드 에디터와 24/7 AI 튜터), CoddyKit PRO로 업그레이드하면 Advanced Spring Boot 4: Event-Driven Architecture (Kafka) 강의 전체를 잠금 해제할 수 있습니다. Advanced Spring Boot 4: Event-Driven Architecture (Kafka) 강의에는 총 4개의 강의가 포함되어 있습니다.

“ACL을 활용한 권한 부여”에서 뭘 배우나요?

Kafka 브로커에 액세스 제어 목록(ACL)을 구현하여 프로듀서와 컨슈머에 세분화된 권한을 정의합니다. 브라우저에서 직접 실행하는 실습 코드로 Advanced Spring Boot 4: Event-Driven Architecture (Kafka)을(를) 배우며, 24/7 AI 튜터가 강의를 진행하면서 질문에 답변해줍니다.

Advanced Spring Boot 4: Event-Driven Architecture (Kafka)을(를) 시작하는 데 경험이 필요한가요?

사전 경험은 필요하지 않습니다. CoddyKit의 Advanced Spring Boot 4: Event-Driven Architecture (Kafka)은(는) 초급자부터 고급 학습자까지를 위해 구성되어 있으므로, 여기서 시작하거나 처음부터 시작할 수 있으며 자신의 속도대로 진행할 수 있습니다. 이것은 4개 중 2번째 강의입니다.

“ACL을 활용한 권한 부여” 강의는 얼마나 걸리나요?

대부분의 CoddyKit 강의는 약 5~10분이 소요됩니다. 각 강의는 간결하고 인터랙티브하여 꾸준한 진행이 가능하며, 웹과 앱에서 중단한 부분부터 바로 시작할 수 있습니다.

이 Advanced Spring Boot 4: Event-Driven Architecture (Kafka) 강의에서 코드를 작성하고 실행할 수 있나요?

네. 모든 Advanced Spring Boot 4: Event-Driven Architecture (Kafka) 강의에는 내장 코드 에디터가 포함되어 있으므로, 브라우저에서 바로 실제 코드를 작성하고 실행한 후 즉시 AI 피드백을 받을 수 있습니다 — 로컬 설정이 필요 없습니다.

이 강의의 모든 강의

← Advanced Spring Boot 4: Event-Driven Architecture (Kafka)(으)로 돌아가기