---
title: "Granting Kafka Permissions in an Identity Policy"
slug: "granting-kafka-permissions-in-an-identity-policy-tg"
updated: 2026-10-28T01:54:33Z
published: 2026-10-28T01:54:33Z
canonical: "docs.vastdata.com/granting-kafka-permissions-in-an-identity-policy-tg"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Granting Kafka Permissions in an Identity Policy

You grant permissions for Kafka-related objects by listing operations that a user is allowed or prohibited to perform in the user's identity policy. The statements in the identity policy act as the Kafka topic-level Access Control List (ACL).

> [!NOTE]
> Note
> 
> To learn how to create an identity policy, see [Creating Identity Policies](/docs-5-4/docs/creating-identity-policies-tg).

By default, if no applicable policy statements are found, the operation is allowed for any user. If you want to alter this behavior, contact VAST Support.

The following Kafka operations are supported:

- For a topic:

  - Read
  - Write
  - AlterConfigs
  - Create
  - Delete
  - Describe
  - DescribeConfigs
- For a consumer group:

  - Read
  - Delete
  - Describe
- For a Kafka cluster (the Kafka-enabled view):

  - Alter
  - AlterConfig
  - ClusterAction
  - Create
  - Describe
  - DescribeConfigs

For example, the following identity policy allows the user to read and write to the topic, but prohibits topic creation and deletion:

```plaintext
"Version": "2012-10-17",
"Statement": [
  {
    "Sid": "Aaa__gggg",
    "Action": "KafkaRead",
    "Effect": "Allow",
    "Resource": "vast:kafka:topic:kafka-pppp:ddd_0"
  },
  {
    "Sid": "Aaa__ssss",
    "Action": "KafkaWrite",
    "Effect": "Allow",
    "Resource": "vast:kafka:topic:kafka-pppp:ddd_0"
  },
  {
    "Sid": "Aaa__dddd",
    "Action": "KafkaCreate",
    "Effect": "Deny",
    "Resource": "vast:kafka:topic:kafka-pppp:ddd_0"
  },
  {
    "Sid": "Aaa__cccc",
    "Action": "KafkaDelete",
    "Effect": "Deny",
    "Resource": "vast:kafka:topic:kafka-pppp:ddd_0"
  },
]
```