How do you secure a Kafka cluster with SASL and ACLs?

Kafka security generally layers two separate concerns: authentication (proving who a client is) and authorization (deciding what an authenticated client is allowed to do), typically combined with encryption in transit.

# broker config
listeners=SASL_SSL://0.0.0.0:9093
sasl.enabled.mechanisms=SCRAM-SHA-512
security.inter.broker.protocol=SASL_SSL

SASL (commonly SCRAM or OAUTHBEARER in current deployments, PLAIN for simpler setups) handles authentication, verifying a client's credentials during connection setup; pairing it with SSL/TLS (SASL_SSL) also encrypts the connection itself, so credentials and data aren't sent in the clear.

kafka-acls.sh --add --allow-principal User:order-service \
  --operation Write --topic orders --bootstrap-server localhost:9093

ACLs then handle authorization: once a client's identity is established, ACLs define exactly which operations (read, write, create, describe) that principal is permitted on which resources (specific topics, consumer groups, or the whole cluster). The combination is what lets a shared multi-tenant cluster enforce that, say, a billing service's producer can write to its own topic but has no read or write access to an unrelated HR topic on the same cluster.

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.

Webull! Receive free stock by signing up using the link: Webull signup.