Scenario 10.5.2 · RBAC: role bindings
Confluent RBAC role bindings for Kafka topics
A role bundles grants once; binding a principal to it grants those permissions by inheritance - no per-principal ACL needed.
Run this scenario in the playgroundRole defined · not bound. t+0.000s
Authorization is on with no ACLs, but a role orders-writer is defined - a named bundle granting Write + Describe on the orders topic. A role on its own grants nothing; it must be bound to a principal. Producer p1 authenticates as App:payments-svc and is bound to nothing yet.
Open at this step: step 1, Role defined · not boundProduce denied (no binding). t+1.000s
p1 produces to orders. App:payments-svc has no ACL and no role binding, so deny-by-default refuses the Write with TopicAuthorizationException - nothing is appended. The role exists, but until it is bound it confers no permission.
Open at this step: step 2, Produce denied (no binding)Principal bound to orders-writer. t+1.700s
App:payments-svc is bound to the orders-writer role. RBAC layers indirection over ACLs: the principal now inherits every grant the role carries (Write + Describe on orders) - without a single per-principal ACL being written.
Open at this step: step 3, Principal bound to orders-writerAuthorized via inherited grant. t+2.300s
The same producer now writes successfully - authorized purely by the role binding's inherited Write grant. One binding replaced the explicit ALLOW ACL of 10.5.1; binding more principals to the role would authorize them all at once.
Open at this step: step 4, Authorized via inherited grantWhat you start with
RBAC layers role bindings over raw ACLs: a role bundles a set of grants once, and binding a principal to that role confers all of them by inheritance. This scenario binds a principal to a role and watches it gain the role's permissions without any per-principal ACL.
Step by step
- Role defined · not bound t+0.000s Authorization is on with no ACLs, but a role orders-writer is defined - a named bundle granting Write + Describe on the orders topic. A role on its own grants nothing; it must be bound to a principal. Producer p1 authenticates as App:payments-svc and is bound to nothing yet. Open at this step: step 1, Role defined · not bound
- Produce denied (no binding) t+1.000s p1 produces to orders. App:payments-svc has no ACL and no role binding, so deny-by-default refuses the Write with TopicAuthorizationException - nothing is appended. The role exists, but until it is bound it confers no permission. Open at this step: step 2, Produce denied (no binding)
- Principal bound to orders-writer t+1.700s App:payments-svc is bound to the orders-writer role. RBAC layers indirection over ACLs: the principal now inherits every grant the role carries (Write + Describe on orders) - without a single per-principal ACL being written. Open at this step: step 3, Principal bound to orders-writer
- Authorized via inherited grant t+2.300s The same producer now writes successfully - authorized purely by the role binding's inherited Write grant. One binding replaced the explicit ALLOW ACL of 10.5.1; binding more principals to the role would authorize them all at once. Open at this step: step 4, Authorized via inherited grant
The takeaway
Roles make authorization scale - you manage permissions on a handful of roles instead of writing one ACL per principal, and a single binding grants or revokes the whole bundle.
Embed this scenario
Paste this into a blog post, a course page or your team's docs. The scenario plays inside your page, and the link under it points readers to this walkthrough.
<iframe src="https://monedula.dev/kafka-simulator/embed/?scenario=10.5.2" title="Kafka Simulator: RBAC: role bindings" width="100%" height="520" style="border:1px solid #d0d0d0;border-radius:8px" loading="lazy"></iframe>
<p><a href="https://monedula.dev/kafka-simulator/scenarios/rbac-role-bindings/">Confluent RBAC role bindings for Kafka topics</a></p>