Docs

Message Queue for Kafka

Access control

Cross-service access

Before using Message Queue for Kafka for the first time, you need to perform cross-service authorization to allow Message Queue for Kafka to access other service resources under the current account, such as VPC. This topic introduces the steps for cross-service access authorization.

Note

Cross-service access authorization is only required before creating a Kafka instance for the first time. After authorization, Kafka can continuously access resources in other services until the service-linked role is deleted.

The permissions of the service-linked role are system-generated and can not be altered. If you need to revoke authorization, delete the role.

We recommend that you complete cross-service access authorization through the VolcanoEngine main account. Otherwise, the first Kafka instance created by an IAM user will fail cross-service authorization due to lack of permission to create a service-linked role. If your actual business scenario requires an IAM user to perform cross-service access authorization, you can grant the IAMFullAccess system policy to the IAM user. For detailed information, refer to Policy strategy.

Background information

Message Queue for Kafka instances require binding to VPC and subnet resources. When creating a Kafka instance, the Message Queue for Kafka service needs access to private networks and other services to obtain VPC and subnet lists. Before creating a Kafka instance for the first time, you must authorize the Message Queue for Kafka service. This means the service can play a ServiceRoleForKafka role. This role includes a set of permission policies that is preset and allow Message Queue for Kafka to access other service resources in your account.

Operation steps

Select the region where you want to create the instance from the top menu bar.

On the Instances page, click Create Instance in the upper left page corner.

On the prompt Cross-service access request page, confirm the associated role and trust relationship, then click Authorize.

After successful authorization, you can view the created ServiceRoleForKafka service-linked role in the IAM role list.

Next steps

After authorization, the page returns to the Instances page. You can click Create Instance again to create your first Kafka instance.

Last updated: 2025.10.15 10:11:16