Managing Apache Kafka® users

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

1. To get a list of users, run the following command:

   yc managed-kafka user list --cluster-name <cluster_name>
   

2. To get detailed information for a specific user, run this command:

   yc managed-kafka user get <username> --cluster-name <cluster_name>
   

To find out the cluster name, get a list of clusters in the folder.

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Use the User.list method and send the following request, e.g., via cURL:

   curl \
     --request GET \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>/users'
   

   You can request the cluster ID with the list of clusters in the folder.

3. View the server response to make sure the request was successful.

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume the repository contents are stored in the ~/cloudapi/ directory.

3. Use the UserService/List call and send the following request, e.g., via gRPCurl:

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>"
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.kafka.v1.UserService.List
   

   You can request the cluster ID with the list of clusters in the folder.

4. View the server response to make sure the request was successful.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

To create a user:

1. View a description of the CLI create user command:

   yc managed-kafka user create --help
   

2. Create a user with the producer role for the producer or the consumer role for the consumer and grant access permissions for the relevant topics:

   yc managed-kafka user create <username> \
     --cluster-name <cluster_name> \
     --password <password> \
     --permission topic=<topic_name>,role=<user's_role>,allow_host=<allowed_IP_address_1>,allow_host=<allowed_IP_address_2>,...,allow_host=<allowed_IP_address_N>
   

   The --permission parameter must include at least one topic-role pair, where:

   • topic: Topic name.
   • role: User’s role, producer, consumer, or admin.
   • allow_host: (Optional) IP address the user is allowed to access the topic from. To specify multiple addresses, add the required number of allow_host options separated by commas.

To create an admin user to manage cluster topics:

1. See the description of the create user CLI command:

   yc managed-kafka user create --help
   

2. Create a user with the admin role valid for all (*) cluster topics:

   yc managed-kafka user create <username> \
     --cluster-name <cluster_name> \
     --password <password> \
     --permission topic=*,role=admin,allow_host=<allowed_IP_address_1>,allow_host=<allowed_IP_address_2>,...,allow_host=<allowed_IP_address_N>
   

To find out the cluster name, get a list of clusters in the folder.

1. Open the current Terraform configuration file with an infrastructure plan.

   For more information about creating this file, see Creating clusters.

2. Add the yandex_mdb_kafka_user resource:

   resource "yandex_mdb_kafka_user" "<username>" {
     cluster_id = "<cluster_ID>"
     name       = "<username>"
     password   = "<password>"
     ...
   }
   

   Note

   The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter or underscore.

   The password must be from 8 to 128 characters long.

3. Grant access permissions for the relevant topics.

4. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

5. Confirm updating the resources.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see the Terraform provider documentation.

resource "yandex_mdb_kafka_cluster" "<cluster_name>" {
  ...
  timeouts {
    create = "1h30m" # 1 hour 30 minutes
    update = "2h"    # 2 hours
    delete = "30m"   # 30 minutes
  }
}

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Use the User.create method and send the following request, e.g., via cURL:

   curl \
     --request POST \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --header "Content-Type: application/json" \
     --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>/users' \
     --data '{
               "userSpec": {
                 "name": "<username>",
                 "password": "<user_password>",
                 "permissions": [
                   {
                     "topicName": "<topic_name>",
                     "role": "<level_of_topic_access_permissions>",
                     "allowHosts": [
                       <list_of_IP_addresses>
                     ]
                   }
                 ]
               }
             }'
   

   Where userSpec represents the new Apache Kafka® user settings:

   • name: Username.

   • password: User password.

     Note

     The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter or underscore.

     The password must be from 8 to 128 characters long.

   • permissions: Topic access permissions. Each array element is for a separate topic and has the following structure:

     • topicName: Topic name or name template:
       • * to allow access to any topics.
       • Full topic name to allow access to a specific topic. To find out the name, get a list of cluster topics.
       • <prefix>* to grant access to topics whose names start with the prefix. Let's assume you have topics named topic_a1, topic_a2, and a3. If you put topic*, access will be granted to topic_a1 and topic_a2. To include all the cluster's topics, use the * mask.
     • role: User’s role, ACCESS_ROLE_CONSUMER, ACCESS_ROLE_PRODUCER, or ACCESS_ROLE_ADMIN. The ACCESS_ROLE_ADMIN role is only available if all topics are selected (topicName: "*").
     • allowHosts: (Optional) List of IP addresses the user is allowed to access the topic from.

   You can request the cluster ID with the list of clusters in the folder.

3. View the server response to make sure the request was successful.

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume the repository contents are stored in the ~/cloudapi/ directory.

3. Use the UserService/Create call and send the following request, e.g., via gRPCurl:

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>",
           "user_spec": {
             "name": "<username>",
             "password": "<user_password>",
             "permissions": [
                {
                  "topic_name": "<topic_name>",
                  "role": "<level_of_topic_access_permissions>",
                  "allow_hosts": [
                    <list_of_IP_addresses>
                  ]
                }
             ]
           }
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.kafka.v1.UserService.Create
   

   Where user_spec represents the new DB user settings:

   • name: Username.

   • password: User password.

     Note

     The username may contain Latin letters, numbers, hyphens, and underscores but must begin with a letter or underscore.

     The password must be from 8 to 128 characters long.

   • permissions: Topic access permissions. Each array element is for a separate topic and has the following structure:

     • topic_name: Topic name or name template:
       • * to allow access to any topics.
       • Full topic name to allow access to a specific topic. To find out the name, get a list of cluster topics.
       • <prefix>* to grant access to topics whose names start with the prefix. Let's assume you have topics named topic_a1, topic_a2, and a3. If you specify topic*, access will be granted to topic_a1 and topic_a2.
     • role: User’s role, ACCESS_ROLE_CONSUMER, ACCESS_ROLE_PRODUCER, or ACCESS_ROLE_ADMIN. The ACCESS_ROLE_ADMIN role is only available if all topics are selected (topic_name: "*").
     • allow_hosts: (Optional) List of IP addresses the user is allowed to access the topic from.

   You can request the cluster ID with the list of clusters in the folder.

4. View the server response to make sure the request was successful.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

Using the CLI, you can change a user's password, grant or revoke topic access permissions.

1. Open the current Terraform configuration file with an infrastructure plan.

   For more information about creating this file, see Creating clusters.

2. In this file, locate the yandex_mdb_kafka_user resource for the user and make the changes.

   Using Terraform, you can change a user's password, grant or revoke topic access permissions.

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Use the User.update method and send the following request, e.g., using cURL:

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the updateMask parameter as a single comma-separated string.

   curl \
     --request PATCH \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --header "Content-Type: application/json" \
     --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>/users/<username>' \
     --data '{
               "updateMask": "permissions",
               "permissions": [
                 {
                  "topicName": "<topic_name>",
                  "role": "<level_of_topic_access_permissions>",
                  "allowHosts": [
                    <list_of_IP_addresses>
                  ]
                }
               ]
             }'
   

   Where:

   • updateMask: List of parameters to update as a single string, separated by commas.

     Here only one parameter is specified: permissions.

   • permissions: New set of access permissions for topics. Each array element is for a separate topic and has the following structure:

     • topicName: Topic name or name template. To find out the name, get a list of cluster topics. To include all the cluster's topics, use the * mask.
     • role: User’s new role, e.g., ACCESS_ROLE_CONSUMER, ACCESS_ROLE_PRODUCER, or ACCESS_ROLE_ADMIN. The ACCESS_ROLE_ADMIN role is only available if all topics are selected (topicName: "*").
     • allowHosts: (Optional) New list of IP addresses the user is allowed to access the topic from.

   You can request the cluster ID with the list of clusters in the folder and the username, with the list of users in the cluster.

3. View the server response to make sure the request was successful.

You can also use the User.update method to change a user's password, and the grantPermission and revokePermission methods to grant or revoke topic access permissions.

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume the repository contents are stored in the ~/cloudapi/ directory.

3. Use the UserService/Update call and send the following request, e.g., using gRPCurl:

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the update_mask parameter as an array of paths[] strings.

   Format for listing settings

   "update_mask": {
       "paths": [
           "<setting_1>",
           "<setting_2>",
           ...
           "<setting_N>"
       ]
   }
   

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>",
           "user_name": "<username>",
           "update_mask": {
             "paths": [
               "permissions"
             ]
           },
           "permissions": [
             {
               "topic_name": "<topic_name>",
               "role": "<level_of_topic_access_permissions>",
               "allow_hosts": [
                 <list_of_IP_addresses>
               ]
             }
           ]
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.kafka.v1.UserService.Update
   

   Where:

   • update_mask: List of parameters to update as an array of paths[] strings.

     In this case, the array consists of only one string, permissions.

   • permissions: New set of access permissions for topics. Each array element is for a separate topic and has the following structure:

     • topic_name: Topic name or name template. To find out the name, get a list of cluster topics. To include all the cluster's topics, use the * mask.
     • role: User’s new role, e.g., ACCESS_ROLE_CONSUMER, ACCESS_ROLE_PRODUCER, or ACCESS_ROLE_ADMIN. The ACCESS_ROLE_ADMIN role is only available if all topics are selected (topic_name: "*").
     • allow_hosts: (Optional) New list of IP addresses the user is allowed to access the topic from.

   You can request the cluster ID with the list of clusters in the folder and the username, with the list of users in the cluster.

4. View the server response to make sure the request was successful.

You can also use the UserService/Update call to change a user’s password, and the grantPermission and revokePermission methods to grant or revoke topic access permissions.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

To change the user password, run this command:

yc managed-kafka user update <username> \
  --cluster-name <cluster_name> \
  --password <new_password>

To find out the cluster name, get a list of clusters in the folder.

1. Open the current Terraform configuration file with an infrastructure plan.

   For more information about creating this file, see Creating clusters.

2. Locate the user's yandex_mdb_kafka_user resource in the file.

3. Change the value of the password field:

   resource "yandex_mdb_kafka_user" "<username>" {
     ...
     password = "<password>"
     ...
   }
   

   Note

   The password must be between 8 and 128 characters.

4. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

5. Confirm updating the resources.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see the Terraform provider documentation.

resource "yandex_mdb_kafka_cluster" "<cluster_name>" {
  ...
  timeouts {
    create = "1h30m" # 1 hour 30 minutes
    update = "2h"    # 2 hours
    delete = "30m"   # 30 minutes
  }
}

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Use the User.update method and send the following request, e.g., using cURL:

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the updateMask parameter as a single comma-separated string.

   curl \
     --request PATCH \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --header "Content-Type: application/json" \
     --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>/users/<username>' \
     --data '{
               "updateMask": "password",
               "password": "<new_user_password>"
             }'
   

   Where:

   • updateMask: List of parameters to update as a single string, separated by commas.

     Here only one parameter is specified: password.

   • password: New user password.

     Note

     The password must be between 8 and 128 characters.

   You can request the cluster ID with the list of clusters in the folder and the username, with the list of users in the cluster.

3. View the server response to make sure the request was successful.

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume the repository contents are stored in the ~/cloudapi/ directory.

3. Use the UserService/Update call and send the following request, e.g., using gRPCurl:

   Warning

   The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the update_mask parameter as an array of paths[] strings.

   Format for listing settings

   "update_mask": {
       "paths": [
           "<setting_1>",
           "<setting_2>",
           ...
           "<setting_N>"
       ]
   }
   

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>",
           "user_name": "<username>",
           "update_mask": {
             "paths": [
               "password"
             ]
           },
           "password": "<new_user_password>"
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.kafka.v1.UserService.Update
   

   Where:

   • update_mask: List of parameters to update as an array of paths[] strings.

     In this case, the array consists of only one string, password.

   • password: New user password.

     Note

     The password must be between 8 and 128 characters.

   You can request the cluster ID with the list of clusters in the folder and the username, with the list of users in the cluster.

4. View the server response to make sure the request was successful.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

To grant user permissions:

1. Retrieve a list of cluster topics:

   yc managed-kafka topic list --cluster-name <cluster_name>
   

2. Grant access permissions for required topics by providing the --permission parameters:

   yc managed-kafka user update <username> \
     --cluster-name <cluster_name> \
     --permission topic=<topic_name>,role=<user's_role>,allow_host=<allowed_IP_address_1>,allow_host=<allowed_IP_address_2>,...,allow_host=<allowed_IP_address_N>
   

   The following --permission parameters are available:

   • topic: Name of the topic to issue permissions for.

     If the user does not need permissions to certain topics, you can revoke them.

   • role: User’s role, producer, consumer, or admin.

     The admin role is only available if all topics are selected (topic=*).

   • allow_host: (Optional) IP address the user is allowed to access the topic from. To specify multiple addresses, add the required number of allow_host options separated by commas.

   When you update user permissions, existing permissions get revoked and replaced with new ones. This means the command must always include a complete list of permissions to be assigned to the user.

   For example, to grant permissions to a user named test-user in the kafka-cli cluster for the topic2 topic with the producer role, while keeping the existing topic1 permissions, run this command:

   yc managed-kafka user update test-user \
     --cluster-name kafka-cli \
     --permission topic=topic1,role=consumer \
     --permission topic=topic2,role=producer
   

   Along with access to the topic, users also gain access to data schema subjects. The availability of subjects depends on the specified roles and topics. For more information, see Managed Schema Registry subjects.

To find out the cluster name, get a list of clusters in the folder.

1. Open the current Terraform configuration file with an infrastructure plan.

   For more information about creating this file, see Creating clusters.

2. Locate the user's yandex_mdb_kafka_cluster resource in the file.

3. Add the permission section:

   resource "yandex_mdb_kafka_user" "<username>" {
     ...
     permission {
       topic_name  = "<topic>"
       role        = "<user's_role>"
       allow_hosts = [ <list_of_allowed_IP_addresses> ] 
     }
   }
   

   Where:

   • topic_name: Topic name. Specify the following:

     • * to allow access to any topics.
     • Full topic name to allow access to a specific topic.
     • <prefix>* to grant access to topics whose names start with the prefix. Let's assume you have topics named topic_a1, topic_a2, and a3. If you specify topic*, access will be granted to topic_a1 and topic_a2.

   • role: User’s role, ACCESS_ROLE_CONSUMER, ACCESS_ROLE_PRODUCER, or ACCESS_ROLE_ADMIN. The ACCESS_ROLE_ADMIN role is only available if all topics are selected (topic_name = "*").

   • allow_hosts: List of IP addresses the user is allowed to access the topic from.

   Along with access to the topic, users also gain access to data schema subjects. The list of available of subjects depends on the roles and topics you specify. For more information, see Subjects in Managed Schema Registry.

If the user does not need permissions to certain topics, you can revoke them.

1. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

2. Confirm updating the resources.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see the Terraform provider documentation.

resource "yandex_mdb_kafka_cluster" "<cluster_name>" {
  ...
  timeouts {
    create = "1h30m" # 1 hour 30 minutes
    update = "2h"    # 2 hours
    delete = "30m"   # 30 minutes
  }
}

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Use the User.grantPermission method and send the following request, e.g., via cURL:

   curl \
     --request POST \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --header "Content-Type: application/json" \
     --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>/users/<username>:grantPermission' \
     --data '{
               "permission": [
                 {
                  "topicName": "<topic_name>",
                  "role": "<user's_role>",
                  "allowHosts": [
                    <list_of_IP_addresses>
                  ]
                }
               ]
             }'
   

   Where:

   • permission: New access permission for the topic.
     • topicName: Topic name. To find out the name, get a list of cluster topics.
     • role: User’s role, ACCESS_ROLE_CONSUMER, ACCESS_ROLE_PRODUCER, or ACCESS_ROLE_ADMIN. The ACCESS_ROLE_ADMIN role is only available if all topics are selected (topicName = "*").
     • allowHosts: (Optional) List of IP addresses the user is allowed to access the topic from.

   You can request the cluster ID with the list of clusters in the folder and the username, with the list of users in the cluster.

3. View the server response to make sure the request was successful.

Along with access to the topic, users also gain access to data schema subjects. The availability of subjects depends on the specified roles and topics. For more information, see Managed Schema Registry subjects.

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume the repository contents are stored in the ~/cloudapi/ directory.

3. Use the UserService/GrantPermission call and send the following request, e.g., via gRPCurl:

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>",
           "user_name": "<username>",
           "permission": [
             {
               "topic_name": "<topic_name>",
               "role": "<user's_role>",
               "allow_hosts": [
                 <list_of_IP_addresses>
               ]
             }
           ]
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.kafka.v1.UserService.GrantPermission
   

   Where:

   • permission: New access permission for the topic.
     • topic_name: Topic name or name template. To find out the name, get a list of cluster topics. To include all the cluster's topics, use the * mask.
     • role: User’s role, ACCESS_ROLE_CONSUMER, ACCESS_ROLE_PRODUCER, or ACCESS_ROLE_ADMIN. The ACCESS_ROLE_ADMIN role is only available if all topics are selected (topic_name = "*").
     • allow_hosts: (Optional) List of IP addresses the user is allowed to access the topic from.

   You can request the cluster ID with the list of clusters in the folder and the username, with the list of users in the cluster.

4. View the server response to make sure the request was successful.

Along with access to the topic, users also gain access to data schema subjects. The availability of subjects depends on the specified roles and topics. For more information, see Managed Schema Registry subjects.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

To revoke access permissions for specific topics, provide an updated list of --permission parameters:

yc managed-kafka user update <username> \
  --cluster-name <cluster_name> \
  --permission topic=<topic_name>,role=<user's_role>,allow_host=<allowed_IP_address_1>,allow_host=<allowed_IP_address_2>,...,allow_host=<allowed_IP_address_N>

When you update user permissions, existing permissions get revoked and replaced with new ones. This means the command must always include a complete list of permissions to be assigned to the user.

The --permission parameter must include at least one topic-role pair, where:

• topic: Topic name.
• role: User’s role, producer, consumer, or admin.
• allow_host: (Optional) IP address the user is allowed to access the topic from. To specify multiple addresses, add the required number of allow_host options separated by commas.

To find out the cluster name, get a list of clusters in the folder.

To revoke all the permissions granted to the user, use the console or delete the user.

1. Open the current Terraform configuration file with an infrastructure plan.

   For more information about creating this file, see Creating clusters.

2. Locate the user's yandex_mdb_kafka_user resource in the file.

3. Edit or delete the permission section.

4. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

5. Confirm updating the resources.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see the Terraform provider documentation.

resource "yandex_mdb_kafka_cluster" "<cluster_name>" {
  ...
  timeouts {
    create = "1h30m" # 1 hour 30 minutes
    update = "2h"    # 2 hours
    delete = "30m"   # 30 minutes
  }
}

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Use the User.revokePermission method and send the following request, e.g., via cURL:

   curl \
     --request POST \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --header "Content-Type: application/json" \
     --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>/users/<username>:revokePermission' \
     --data '{
               "permission": [
                 {
                  "topicName": "<topic_name>",
                  "role": "<user's_role>",
                  "allowHosts": [
                    <list_of_IP_addresses>
                  ]
                }
               ]
             }'
   

   Where:

   • permission: Access permission for the topic to be revoked:
     • topicName: Topic name. To find out the name, get a list of cluster topics.
     • role: User’s role to be revoked, ACCESS_ROLE_CONSUMER or ACCESS_ROLE_PRODUCER.
     • allow_hosts: (Optional) List of IP addresses for which the user’s access permissions to the topic will be revoked.

   You can request the cluster ID with the list of clusters in the folder and the username, with the list of users in the cluster.

3. View the server response to make sure the request was successful.

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume the repository contents are stored in the ~/cloudapi/ directory.

3. Use the UserService/RevokePermission call and send the following request, e.g., via gRPCurl:

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>",
           "user_name": "<username>",
           "permission": [
             {
               "topic_name": "<topic_name>",
               "role": "<user's_role>",
               "allow_hosts": [
                 <list_of_IP_addresses>
               ]
             }
           ]
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.kafka.v1.UserService.RevokePermission
   

   Where:

   • permission: Access permission for the topic to be revoked:
     • topic_name: Topic name or name template. To find out the name, get a list of cluster topics.
     • role: User’s role to be revoked, ACCESS_ROLE_CONSUMER or ACCESS_ROLE_PRODUCER.
     • allow_hosts: (Optional) List of IP addresses for which the user’s access to the topic will be revoked.

   You can request the cluster ID with the list of clusters in the folder and the username, with the list of users in the cluster.

4. View the server response to make sure the request was successful.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

To remove a user, run:

yc managed-kafka user delete <username> --cluster-name <cluster_name>

To find out the cluster name, get a list of clusters in the folder.

1. Open the current Terraform configuration file with an infrastructure plan.

   For more information about creating this file, see Creating clusters.

2. Delete the user's yandex_mdb_kafka_user resource.

3. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

4. Confirm updating the resources.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see the Terraform provider documentation.

resource "yandex_mdb_kafka_cluster" "<cluster_name>" {
  ...
  timeouts {
    create = "1h30m" # 1 hour 30 minutes
    update = "2h"    # 2 hours
    delete = "30m"   # 30 minutes
  }
}

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Use the User.delete method and send the following request, e.g., via cURL:

   curl \
     --request DELETE \
     --header "Authorization: Bearer $IAM_TOKEN" \
     --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>/users/<username>'
   

   You can request the cluster ID with the list of clusters in the folder and the username, with the list of users in the cluster.

3. View the server response to make sure the request was successful.

1. Get an IAM token for API authentication and put it into the environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume the repository contents are stored in the ~/cloudapi/ directory.

3. Use the UserService/Delete call and send the following request, e.g., via gRPCurl:

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/user_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d '{
           "cluster_id": "<cluster_ID>",
           "user_name": "<username>"
         }' \
     mdb.api.cloud.yandex.net:443 \
     yandex.cloud.mdb.kafka.v1.UserService.Delete
   

   You can request the cluster ID with the list of clusters in the folder and the username, with the list of users in the cluster.

4. View the server response to make sure the request was successful.