If you are using a high-level consumer with a consumer group, you must also grant READ permission to the consumer group.

Example:

The following commands grant principal ambari-qa access to consumer group “10” from host c6401.ambari.apache.org. This is done by granting READ permission to the ambari-qa user on that group.

/usr/hdp/current/kafka-broker/bin/kafka-acls.sh --consumer-group 10 --add --allowhosts c6401.ambari.apache.org --allowprincipals user:ambari-qa --operations READ --config /usr/hdp/current/kafka-broker/config/server.properties