Example Policies
This section provides example IAM policies for Lenses.
These are the recommended default role templates. Use them as-is or as a starting point for custom roles tailored to your organization's needs.
For a full list of available actions and resources, see the IAM Reference.
Administrator
Full system access with all permissions. Administrators can manage all resources, users, and system configuration. This role should be granted sparingly and only to trusted personnel.
The admin role grants unrestricted access. Consider creating more granular roles for day-to-day operations.
Developer
Create and manage data infrastructure including topics, connectors, processors, and schemas. Developers can build and deploy data pipelines but cannot manage users or system configuration.
role
name: developer
policy:
# Kafka topics - full management except delete
- action:
- kafka:CreateTopic
- kafka:ListTopics
- kafka:GetTopicDetails
- kafka:UpdateTopicDetails
- kafka:ReadTopicData
- kafka:WriteTopicData
- kafka:ListTopicDependants
resource: kafka:topic:*
effect: allow
# Consumer groups - view and manage
- action:
- kafka:ListConsumerGroups
- kafka:GetConsumerGroupDetails
- kafka:ListConsumerGroupDependants
resource: kafka:consumer-group:*
effect: allow
# Schemas - full management except delete
- action:
- schemas:CreateSchema
- schemas:ListSchemas
- schemas:GetSchemaDetails
- schemas:UpdateSchema
- schemas:GetRegistryConfiguration
resource: schemas:*
effect: allow
# Kafka Connect - create and manage connectors
- action:
- kafka-connect:CreateConnector
- kafka-connect:ListConnectors
- kafka-connect:GetConnectorDetails
- kafka-connect:GetConnectorConfiguration
- kafka-connect:UpdateConnectorConfiguration
- kafka-connect:StartConnector
- kafka-connect:StopConnector
- kafka-connect:ListConnectorDependants
- kafka-connect:ListClusters
- kafka-connect:GetClusterDetails
- kafka-connect:DeployConnector
resource: kafka-connect:*
effect: allow
# SQL Streaming - create and manage processors
- action:
- sql-streaming:CreateProcessor
- sql-streaming:ListProcessors
- sql-streaming:GetProcessorDetails
- sql-streaming:GetProcessorSql
- sql-streaming:UpdateProcessorSql
- sql-streaming:StartProcessor
- sql-streaming:StopProcessor
- sql-streaming:GetProcessorLogs
- sql-streaming:ListProcessorDependants
resource: sql-streaming:*
effect: allow
# Kubernetes - view and deploy
- action:
- kubernetes:ListClusters
- kubernetes:GetClusterDetails
- kubernetes:ListNamespaces
- kubernetes:DeployApps
resource: kubernetes:*
effect: allow
# Applications - register and manage
- action:
- applications:RegisterApplication
- applications:ListApplications
- applications:GetApplicationDetails
- applications:ListApplicationDependants
resource: applications:*
effect: allow
# K2K - create and manage
- action:
- k2k:CreateApp
- k2k:UpdateApp
- k2k:UpsertApp
- k2k:GetApp
- k2k:ListApps
resource: k2k:*
effect: allow
# Governance - submit requests
- action:
- governance:CreateRequest
- governance:ListRequests
- governance:GetRequestDetails
resource: governance:request:*
effect: allow
# Environments - view and access
- action:
- environments:ListEnvironments
- environments:GetEnvironmentDetails
- environments:AccessEnvironment
resource: environments:*
effect: allow
# Alerts - view
- action:
- alerts:ListAlertRules
- alerts:GetAlertRuleDetails
- alerts:ListAlertEvents
- alerts:ListChannels
resource: alerts:*
effect: allow
# Data policies - view
- action:
- data-policies:ListPolicies
- data-policies:GetPolicyDetails
resource: data-policies:*
effect: allowDevelopers can create infrastructure but cannot delete topics/schemas or manage ACLs. Consider adding kafka:DeleteTopic for non-production environments.
Data Engineer
Read and write topic data, manage schemas, and create SQL processors. Data engineers focus on data transformation and pipeline development but have limited infrastructure management capabilities.
Data engineers can work with data but cannot create topics or manage ACLs. They need the developer role for topic creation.
Viewer
Read-only access across all resources. Viewers can browse topics, view configurations, and monitor status but cannot make any changes. Ideal for stakeholders who need visibility without modification rights.
Viewers cannot read topic data (kafka:ReadTopicData). Add that permission explicitly if data browsing is needed.
Operator
Operational management without create/delete permissions. Operators can start, stop, scale, and monitor resources but cannot create new infrastructure or delete existing resources.
Operators focus on keeping systems running. They cannot create or delete infrastructure, only manage operational state.
Security Administrator
IAM and security management without data access. Security admins manage users, roles, groups, service accounts, ACLs, and audit logs but cannot read or write topic data.
Security admins cannot read topic data, ensuring separation between security management and data access.
Governance Administrator
Approve governance requests and manage data policies. Governance admins review and approve/deny self-service requests and configure governance rules and data protection policies.
Governance admins need underlying permissions (e.g., kafka:CreateTopic) to approve requests that create resources.
Environment-Scoped Roles
The roles above grant access across all environments. To restrict access to specific environments, modify the resource patterns.
Developer for specific environment
Restrict developer access to only the us-dev environment:
Deny production access
Explicitly deny access to production environments:
Deny rules take precedence over allow rules. Use this pattern to create guardrails that prevent accidental production access.
Last updated
Was this helpful?