To add the following ACL:

"Principals user:bob and user:alice are allowed to perform Operation Read and Write on Topic Test-Topic from Host1 and Host2"

run the CLI with the following options:

bin/kafka-acls.sh --add --allow-principal user:bob --allow-principal user:alice --allow-host host1 --allow-host host2 --operation Read --operation Write --topic test-topic

To add ACLs to a topic, specify --topic <topic-name> as the resource option. Similarly, to add ACLs to cluster, specify --cluster; to add ACLs to a consumer group, specify --consumer-group <group-name>.

The following examples grant full access for principal bob to topic test-topic and consumer group 10, across the cluster. Substitute your own values for principal name, topic name, and group name.

bin/kafka-acls.sh --topic test-topic --add --allow-principal user:bob --operation ALL --config /usr/hdp/current/kafka-broker/config/server.properties

bin/kafka-acls.sh --consumer-group 10 --add --allow-principal user:bob --operation ALL --config /usr/hdp/current/kafka-broker/config/server.properties

bin/kafka-acls.sh --cluster --add --allow-principal user:bob --operation ALL --config /usr/hdp/current/kafka-broker/config/server.properties

The most common use case for ACL management is to add or remove a principal as producer or consumer. The following convenience options handle these cases.

To add user:bob as a producer of Test-topic, run the following command:

bin/kafka-acls.sh --add --allow-principal user:bob --producer --topic test-topic

Similarly, to add user:alice as a consumer of test-topic with consumer group group-1, pass the --consumer option.

	Note
	When using the consumer option you must specify the consumer group.

bin/kafka-acls.sh --add --allow-principal user:bob --consumer --topic test-topic --consumer-group group-1

In rare cases you might want to define an ACL that allows access to all but one or more principals. In this case, use the --deny-principal and --deny-host options.

For example, to allow all users to read from test-topic except user bob from host bad-host:

bin/kafka-acls.sh --add --allow-principal user:* --allow-host * --deny-principal user:bob --deny-host bad-host --operation Read --topic test-topic

Removing ACLs is similar to adding ACLs. The only difference is that you need to specify the --remove option instead of the --add option.

To remove the ACLs for principals bob and alice (added in "Grant Read/Write Access to a Topic"), run the CLI with the following options:

bin/kafka-acls.sh --remove --allow-principal user:bob --allow-principal user:alice --allow-host host1 --allow-host host2 --operation Read --operation Write --topic test-topic

Similarly, to remove a principal from a producer or consumer role, specify the --remove option instead of --add:

bin/kafka-acls.sh --remove --allow-principal user:bob --producer --topic test-topic

To list ACLs for any resource, specify the --list option with the resource. For example, to list all ACLs for Test-topic, run the CLI with following options:

bin/kafka-acls.sh --list --topic test-topic

To specify which authorizer to use, include the --authorizer option. For example:

--authorizer kafka.security.auth.SimpleAclAuthorizer ...

To specify one or more authorizer initialization settings, include the --authorizer-properties option; for example:

--authorizer-properties zookeeper.connect=localhost:2181 ...