Migrating from Role to Attribute-based Access Control

This post details the migration from RBAC to ABAC for Grab's Kafka Control Plane (KCP). It explains the challenges of RBAC, including managing a large number of roles and permissions, manual approval backlogs, and outdated group memberships. The ABAC solution leverages user attributes synced from HRMS, resource attributes captured during provisioning, and Open Policy Agent (OPA) with Rego policies for evaluation. The architecture involves KCP calling IAM for authentication and token generation, extracting user attributes from the token, fetching resource attributes, and then making an authorization call to OPA. The post highlights the benefits of ABAC, such as optimized resource allocation, simplified resource management, reduced delays, and better governance. It also discusses learnings, including the need for a reliable attribute tagging system and keeping tags up-to-date.