Kafka Streams and KSQL with Minimum Privileges | Confluent

What this post added

Introduces the concept of prefixed ACLs in Kafka (KIP-290) enabled by Confluent Platform 5.0+ and Apache Kafka 2.0+. Details two patterns for configuring these ACLs: 1) Team-level prefixes (e.g., 'team.fraud.') allowing read/write/create on all topics and groups starting with that prefix, and 2) Application-level prefixes (e.g., 'mobile.payments.fraud') for more granular control. Explains how to apply these patterns to both Kafka Streams (using `application.id`) and KSQL (using `ksql.service.id`), including the specific prefixes for internal KSQL topics (e.g., '_confluent-ksql-team.fraud').