search
ProductsDownload Community Edition

Example Policies

This section provides example IAM policies for Lenses.

These are the recommended default role templates. Use them as-is or as a starting point for custom roles tailored to your organization's needs.

circle-info

For a full list of available actions and resources, see the IAM Reference.

hashtag
Administrator

Full system access with all permissions. Administrators can manage all resources, users, and system configuration. This role should be granted sparingly and only to trusted personnel.

chevron-rightrolehashtag
name: administrator
policy:
  - action: "*"
    resource: "*"
    effect: allow
circle-exclamation

The admin role grants unrestricted access. Consider creating more granular roles for day-to-day operations.

hashtag
Developer

Create and manage data infrastructure including topics, connectors, processors, and schemas. Developers can build and deploy data pipelines but cannot manage users or system configuration.

chevron-rightrolehashtag
name: developer
policy:
  # Kafka topics - full management except delete
  - action:
      - kafka:CreateTopic
      - kafka:ListTopics
      - kafka:GetTopicDetails
      - kafka:UpdateTopicDetails
      - kafka:ReadTopicData
      - kafka:WriteTopicData
      - kafka:ListTopicDependants
    resource: kafka:topic:*
    effect: allow
  # Consumer groups - view and manage
  - action:
      - kafka:ListConsumerGroups
      - kafka:GetConsumerGroupDetails
      - kafka:ListConsumerGroupDependants
    resource: kafka:consumer-group:*
    effect: allow
  # Schemas - full management except delete
  - action:
      - schemas:CreateSchema
      - schemas:ListSchemas
      - schemas:GetSchemaDetails
      - schemas:UpdateSchema
      - schemas:GetRegistryConfiguration
    resource: schemas:*
    effect: allow
  # Kafka Connect - create and manage connectors
  - action:
      - kafka-connect:CreateConnector
      - kafka-connect:ListConnectors
      - kafka-connect:GetConnectorDetails
      - kafka-connect:GetConnectorConfiguration
      - kafka-connect:UpdateConnectorConfiguration
      - kafka-connect:StartConnector
      - kafka-connect:StopConnector
      - kafka-connect:ListConnectorDependants
      - kafka-connect:ListClusters
      - kafka-connect:GetClusterDetails
      - kafka-connect:DeployConnector
    resource: kafka-connect:*
    effect: allow
  # SQL Streaming - create and manage processors
  - action:
      - sql-streaming:CreateProcessor
      - sql-streaming:ListProcessors
      - sql-streaming:GetProcessorDetails
      - sql-streaming:GetProcessorSql
      - sql-streaming:UpdateProcessorSql
      - sql-streaming:StartProcessor
      - sql-streaming:StopProcessor
      - sql-streaming:GetProcessorLogs
      - sql-streaming:ListProcessorDependants
    resource: sql-streaming:*
    effect: allow
  # Kubernetes - view and deploy
  - action:
      - kubernetes:ListClusters
      - kubernetes:GetClusterDetails
      - kubernetes:ListNamespaces
      - kubernetes:DeployApps
    resource: kubernetes:*
    effect: allow
  # Applications - register and manage
  - action:
      - applications:RegisterApplication
      - applications:ListApplications
      - applications:GetApplicationDetails
      - applications:ListApplicationDependants
    resource: applications:*
    effect: allow
  # K2K - create and manage
  - action:
      - k2k:CreateApp
      - k2k:UpdateApp
      - k2k:UpsertApp
      - k2k:GetApp
      - k2k:ListApps
    resource: k2k:*
    effect: allow
  # Governance - submit requests
  - action:
      - governance:CreateRequest
      - governance:ListRequests
      - governance:GetRequestDetails
    resource: governance:request:*
    effect: allow
  # Environments - view and access
  - action:
      - environments:ListEnvironments
      - environments:GetEnvironmentDetails
      - environments:AccessEnvironment
    resource: environments:*
    effect: allow
  # Alerts - view
  - action:
      - alerts:ListAlertRules
      - alerts:GetAlertRuleDetails
      - alerts:ListAlertEvents
      - alerts:ListChannels
    resource: alerts:*
    effect: allow
  # Data policies - view
  - action:
      - data-policies:ListPolicies
      - data-policies:GetPolicyDetails
    resource: data-policies:*
    effect: allow
circle-info

Developers can create infrastructure but cannot delete topics/schemas or manage ACLs. Consider adding kafka:DeleteTopic for non-production environments.

hashtag
Data Engineer

Read and write topic data, manage schemas, and create SQL processors. Data engineers focus on data transformation and pipeline development but have limited infrastructure management capabilities.

chevron-rightrolehashtag
circle-info

Data engineers can work with data but cannot create topics or manage ACLs. They need the developer role for topic creation.

hashtag
Viewer

Read-only access across all resources. Viewers can browse topics, view configurations, and monitor status but cannot make any changes. Ideal for stakeholders who need visibility without modification rights.

chevron-rightrolehashtag
circle-exclamation

Viewers cannot read topic data (kafka:ReadTopicData). Add that permission explicitly if data browsing is needed.

hashtag
Operator

Operational management without create/delete permissions. Operators can start, stop, scale, and monitor resources but cannot create new infrastructure or delete existing resources.

chevron-rightrolehashtag
circle-info

Operators focus on keeping systems running. They cannot create or delete infrastructure, only manage operational state.

hashtag
Security Administrator

IAM and security management without data access. Security admins manage users, roles, groups, service accounts, ACLs, and audit logs but cannot read or write topic data.

chevron-rightrolehashtag
circle-info

Security admins cannot read topic data, ensuring separation between security management and data access.

hashtag
Governance Administrator

Approve governance requests and manage data policies. Governance admins review and approve/deny self-service requests and configure governance rules and data protection policies.

chevron-rightrolehashtag
circle-exclamation

Governance admins need underlying permissions (e.g., kafka:CreateTopic) to approve requests that create resources.

hashtag
Environment-Scoped Roles

The roles above grant access across all environments. To restrict access to specific environments, modify the resource patterns.

hashtag
Developer for specific environment

Restrict developer access to only the us-dev environment:

chevron-rightrolehashtag

hashtag
Deny production access

Explicitly deny access to production environments:

chevron-rightrolehashtag
circle-info

Deny rules take precedence over allow rules. Use this pattern to create guardrails that prevent accidental production access.

PreviousIAM ReferenceNextTopics

Last updated

Was this helpful?