Docs

Message Queue for Kafka

Access control

Resources and actions for which the permissions can be granted

Through IAM permission management, you can grant some actions for instance resources of Message Queue for Kafka.

Resources for which permission can be granted

In interfaces that support configuring permissions for users based on resources, you can manage the data access permissions of IAM users across different resources through resource permission. The resource types for which permission can be granted by Message Queue for Kafka through IAM access control are as follows.

tip

You need to replace variable parameters like $region, $account with your actual parameter information.

Resource type	Permissions description	Resource description method
Kafka instance	Assign permissions for the specified instance or all instances.	Specify Kafka instance: trn:Kafka:{$region}:{$accountid}:instance/{$instanceid} All Kafka instances: trn:Kafka:{$region}:{$accountid}:instance/*

Actions for which the permissions can be granted

The actions for which permissions can be granted by Message Queue for Kafka are as follows:

Category	Action	Description
Instance management	CreateInstance	Create a Message Queue for Kafka instance.
		ModifyInstanceParameters	Modify the parameter configuration of the corresponding instance.
		ModifyInstanceAttributes	Modify instance name, description, and other instance information.
		ModifyInstanceSpec	Modify the instance's computing specification, storage specification, partition upgrades, and other product specifications.
		ModifyInstanceChargeType	Change the billing method of the instance.
		DescribeInstances	Get the instances under the current account.
		DescribeInstanceDetail	View the details of the specified instance.
		DeleteInstance	Release the pay-as-you-go instance.
		CreatePublicAddress	Enable the instance's public network access.
		DeletePublicAddress	Disable the instance's public network access.
Topic management	CreateTopic	Create a Kafka topic.
		DeleteTopic	Delete Kafka topic.
		ModifyTopicAttributes	Modify the topic description.
		ModifyTopicParameters	Modify the topic's parameter settings.
		ModifyTopicAccessPolicies	Change the user permissions of the specified topic.
		DescribeTopics	View the Topic list.
		DescribeTopicParameters	View the parameter configuration of the specified topic.
		DescribeTopicPartitions	Get the partition information of the topic.
		DescribeTopicAccessPolicies	View the topic's permission list.
Group management	CreateGroup	Create consumer group (ConsumerGroup).
		ModifyGroup	Modify consumer group description.
		DeleteGroup	Delete consumer group (ConsumerGroup).
		DescribeGroups	Get the list of consumer groups.
		DescribeConsumedTopics	View Topic information subscribed by the consumer group.
		DescribeConsumedPartitions	View partition information of the specified topic subscribed by the consumer group.
		ResetConsumedOffsets	Reset the consumer group's consumption offsets.
SASL user management	CreateUser	Create a Kafka SASL user.
		DeleteUser	Delete Kafka SASL user.
		ModifyUserAuthority	Change the default permissions of the specified SASL user for all users.
		DescribeUsers	Get Kafka SASL user list.
ACL policy management	CreateAcl	Create ACL policy.
		DescribeAcls	Query created ACL rule policies.
		DeleteAcl	Delete ACL policy.
Tag management	AddTagsToResource	Bind tags to the specified instance.
		RemoveTagsFromResource	Unbind tags from one or more instances.
		DescribeTagsByResource	Query resources with bound tags.

Last updated: 2025.10.15 10:11:16