Users & ACLs

Every Streams cluster is created with an admin SCRAM credential. For applications, create separate SCRAM users and grant only the required Kafka ACLs.

Create a user#

exc stream user create \
  --id <cluster_id> \
  --username orders-app

The response includes the generated password once. Store it in Secrets or your own secret manager before you close the terminal.

List users#

exc stream user list --id <cluster_id>

Passwords are never returned by list.

Rotate a password#

exc stream user rotate \
  --id <cluster_id> \
  --username orders-app

Update your application secret with the new password before restarting consumers or producers.

Delete a user#

exc stream user delete \
  --id <cluster_id> \
  --username orders-app

Deleting a user removes its SCRAM credential. Existing clients using that username will fail authentication.

Create ACLs#

Kafka principals use the User:<username> form:

exc stream acl create \
  --id <cluster_id> \
  --principal User:orders-app \
  --resource_type TOPIC \
  --resource_name orders \
  --operation READ \
  --pattern_type LITERAL \
  --permission_type ALLOW \
  --host '*'

Create separate ACLs for each operation the app needs, such as READ, WRITE, CREATE, or DESCRIBE.

List ACLs#

exc stream acl list --id <cluster_id>

Delete an ACL#

exc stream acl delete \
  --id <cluster_id> \
  --acl_id <acl_id>

Required permissions#

See the Policies guide.