TechPrufer
Get started
Grab
Grab logoGrab · Feature trail

Attribute-Based Access Control (ABAC) for Kafka Control Plane

1 post · Mar 2023

What this trail covers

Grab has migrated its Kafka Control Plane (KCP) from Role-Based Access Control (RBAC) to Attribute-Based Access Control (ABAC) to simplify access management, reduce operational overhead, and improve scalability. This involved implementing user and resource attributes, an evaluation engine using Open Policy Agent (OPA) with Rego policies, and integrating with the IAM service and HRMS. The transition has led to optimized resource allocation, simplified management of new resources, reduced delays for access requests, and better governance over resource ownership and costs.

All Grab trails
  1. Migrating from Role to Attribute-based Access ControlThis post details the migration from RBAC to ABAC for Grab's Kafka Control Plane (KCP). It explains the challenges of RBAC, including managing a large number of roles and permissions, manual approval backlogs, and outdated group memberships. The ABAC solution leverages user attributes synced from HRMS, resource attributes captured during provisioning, and Open Policy Agent (OPA) with Rego policies for evaluation. The architecture involves KCP calling IAM for authentication and token generation, extracting user attributes from the token, fetching resource attributes, and then making an authorization call to OPA. The post highlights the benefits of ABAC, such as optimized resource allocation, simplified resource management, reduced delays, and better governance. It also discusses learnings, including the need for a reliable attribute tagging system and keeping tags up-to-date.