acls

Creates, updates, deletes, gets or lists an acls resource.

Overview

Name	acls
Type	Resource
Id	confluent.kafka.acls

Fields

The following fields are returned by SELECT queries:

get_kafka_acls

The list of ACLs.

Name	Datatype	Description
data	array
kind	string
metadata	object

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_kafka_acls	select	cluster_id, kafka_endpoint_id, region, cloud_provider	resource_type, resource_name, pattern_type, principal, host, operation, permission	- When calling /acls without the principal parameter, service accounts are returned in numeric ID format (e.g., User:12345). - To retrieve service accounts in the sa-xxx format, use /acls?principal=UserV2:*. - The principal parameter supports both legacy User: format and new UserV2: format for service accounts. Return a list of ACLs that match the search criteria.
create_kafka_acls	insert	cluster_id, kafka_endpoint_id, region, cloud_provider, resource_type, resource_name, pattern_type, principal, host, operation, permission		Create an ACL.
delete_kafka_acls	delete	resource_type, pattern_type, operation, permission, cluster_id, kafka_endpoint_id, region, cloud_provider	resource_name, principal, host	Delete the ACLs that match the search criteria.
batch_create_kafka_acls	exec	cluster_id, kafka_endpoint_id, region, cloud_provider, data		Create ACLs.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
cloud_provider	string	Cloud provider, lowercase: aws, gcp, or azure (from the cluster spec.cloud). (default: cloud)
cluster_id	string	The Kafka cluster ID. (example: cluster-1)
kafka_endpoint_id	string	Per-cluster Kafka REST endpoint ID (the pkc-* host prefix from the Confluent UI Cluster -> Overview -> REST endpoint, or extract from confluent.managed_kafka_clusters.clusters spec.http_endpoint). (default: pkc-00000)
operation	string	The ACL operation.
pattern_type	string	The ACL pattern type.
permission	string	The ACL permission.
region	string	Cloud region the cluster runs in, e.g. ap-southeast-2 (from the cluster spec.region). (default: region)
resource_type	string	The ACL resource type.
host	string	The ACL host.
operation	string	The ACL operation.
pattern_type	string	The ACL pattern type.
permission	string	The ACL permission.
principal	string	The ACL principal. This is the Service Account name or user name. Supports both legacy User: format (numeric IDs) and new UserV2: format (sa-xxx format) for service accounts. Use UserV2:* to retrieve service accounts in the new format.
resource_name	string	The ACL resource name.
resource_type	string	The ACL resource type.

SELECT examples

get_kafka_acls

• When calling /acls without the principal parameter, service
  accounts are returned in numeric ID format (e.g., User:12345).
  - To retrieve service accounts in the sa-xxx format, use
  /acls?principal=UserV2:*.
  - The principal parameter supports both legacy User: format and
  new UserV2: format for service accounts.
  Return a list of ACLs that match the search criteria.

SELECT
data,
kind,
metadata
FROM confluent.kafka.acls
WHERE cluster_id = '{{ cluster_id }}' -- required
AND kafka_endpoint_id = '{{ kafka_endpoint_id }}' -- required
AND region = '{{ region }}' -- required
AND cloud_provider = '{{ cloud_provider }}' -- required
AND resource_type = '{{ resource_type }}'
AND resource_name = '{{ resource_name }}'
AND pattern_type = '{{ pattern_type }}'
AND principal = '{{ principal }}'
AND host = '{{ host }}'
AND operation = '{{ operation }}'
AND permission = '{{ permission }}'
;

INSERT examples

create_kafka_acls

Create an ACL.

INSERT INTO confluent.kafka.acls (
resource_type,
resource_name,
pattern_type,
principal,
host,
operation,
permission,
cluster_id,
kafka_endpoint_id,
region,
cloud_provider
)
SELECT 
'{{ resource_type }}' /* required */,
'{{ resource_name }}' /* required */,
'{{ pattern_type }}' /* required */,
'{{ principal }}' /* required */,
'{{ host }}' /* required */,
'{{ operation }}' /* required */,
'{{ permission }}' /* required */,
'{{ cluster_id }}',
'{{ kafka_endpoint_id }}',
'{{ region }}',
'{{ cloud_provider }}'
;

Manifest

# Description fields are for documentation purposes
- name: acls
props:
  - name: cluster_id
    value: "{{ cluster_id }}"
    description: Required parameter for the acls resource.
  - name: kafka_endpoint_id
    value: "{{ kafka_endpoint_id }}"
    description: Required parameter for the acls resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the acls resource.
  - name: cloud_provider
    value: "{{ cloud_provider }}"
    description: Required parameter for the acls resource.
  - name: resource_type
    value: "{{ resource_type }}"
    valid_values: ['UNKNOWN', 'ANY', 'TOPIC', 'GROUP', 'CLUSTER', 'TRANSACTIONAL_ID', 'DELEGATION_TOKEN']
  - name: resource_name
    value: "{{ resource_name }}"
  - name: pattern_type
    value: "{{ pattern_type }}"
  - name: principal
    value: "{{ principal }}"
  - name: host
    value: "{{ host }}"
  - name: operation
    value: "{{ operation }}"
  - name: permission
    value: "{{ permission }}"

DELETE examples

delete_kafka_acls

Delete the ACLs that match the search criteria.

DELETE FROM confluent.kafka.acls
WHERE resource_type = '{{ resource_type }}' --required
AND pattern_type = '{{ pattern_type }}' --required
AND operation = '{{ operation }}' --required
AND permission = '{{ permission }}' --required
AND cluster_id = '{{ cluster_id }}' --required
AND kafka_endpoint_id = '{{ kafka_endpoint_id }}' --required
AND region = '{{ region }}' --required
AND cloud_provider = '{{ cloud_provider }}' --required
AND resource_name = '{{ resource_name }}'
AND principal = '{{ principal }}'
AND host = '{{ host }}'
;

Lifecycle Methods

batch_create_kafka_acls

Create ACLs.

EXEC confluent.kafka.acls.batch_create_kafka_acls 
@cluster_id='{{ cluster_id }}' --required, 
@kafka_endpoint_id='{{ kafka_endpoint_id }}' --required, 
@region='{{ region }}' --required, 
@cloud_provider='{{ cloud_provider }}' --required 
@@json=
'{
"data": "{{ data }}"
}'
;