Use RBAC in the Data Plane

Use role-based access control (RBAC) in the data plane to configure cluster-level permissions for provisioned users at scale. RBAC works in conjunction with all supported authentication methods.

RBAC overview

RBAC is designed to address the critical challenge of access management at scale. It alleviates the process of manually maintaining and verifying a set of raw permissions (access control lists, or ACLs) for a user base that could contain thousands of users. RBAC provides a method to onboard new employees easier, audit accesses faster, and adapt more readily to evolutions of usage and compliance needs.

Using RBAC, you can define roles to reflect organizational structure or job duties. This approach decouples users and permissions through the assignment of roles. RBAC allows a one-to-many mapping of a given role to many users, dramatically reducing the number of custom policies needed for a resource from one per user, to one per group of users.

RBAC terminology

Under the RBAC framework, you create roles, grant permissions to those roles, and assign the roles to users. When you change the permissions for a given role, all users with that role automatically gain the modified permissions. You grant or deny permissions for a role by creating an ACL and specifying the RBAC role as either allowed or denied respectively.

Redpanda treats all users as security principals and defines them with the Type:Name syntax (for example, User:mike). You can omit the Type when defining a principal and Redpanda will assume the User: type. All examples here use the full syntax for clarity.

Roles

A role is a named collection of ACLs which may have users (security principals) assigned to it. You can assign any number of roles to a given user. When installing a new Redpanda cluster, no roles are provisioned by default.

When performing an upgrade from older versions of Redpanda, all existing SASL/SCRAM users are assigned to the placeholder Users role to help you more readily migrate away from pure ACLs. As a security measure, this default role has no assigned ACLs.

Policy conflicts

You can assign a combination of ACLs and roles to any given principal. ACLs allow permissions, deny permissions, or specify a combination of both. As a result, users may at times have role assignments with conflicting policies. If this situation arises, the user is permitted to perform an operation if and only if:

  • There does not exist a DENY permission matching the operation.

  • There exists an ALLOW permission matching the operation.

Manage users and roles

Administrators can manage RBAC configurations with Redpanda Cloud.

Create a role

Creating a new role is a two-step process. First you define the role, giving it a unique and descriptive name. Second, you assign one or more ACLs to allow or deny access for the new role. This defines the permissions that are inherited by all users assigned to the role. It is possible to have an empty role with no ACLs assigned.

To create a new role:

  1. Select Security from the left navigation menu.

  2. Select the Roles tab.

  3. Click Create role.

  4. In the Create role view, provide a name for the role and an optional origin host for users to connect from.

  5. Define the permissions (access control lists, ACLs) for the role. You can create ACLs for topics, consumer groups, and transactional IDs.

  6. (Optional) You can assign one or more principals (users) to the role when creating it.

  7. Click Create.

Delete a role

When a role is deleted, Redpanda carries out the following actions automatically:

  • All role ACLs are deleted.

  • All users' assignments to the role are removed.

Redpanda lists all impacted ACLs and role assignments when running this command. You receive a prompt to confirm the deletion action. The delete operation is irreversible.

To delete an existing role:

  1. Select Security from the left navigation menu.

  2. Click the role you want to delete. This shows all currently assigned permissions (ACLs) and principals (users).

  3. Click Delete.

  4. Redpanda Cloud displays a prompt asking you to confirm deletion of the role. The prompt differs based on whether there are principals assigned to the role or not. If there are principals assigned to the role, you must type the role name in the input field when prompted before you can continue.

  5. Click Delete.

Assign a role

You can assign a role to any security principal. Principals are referred to using the format: Type:Name. Redpanda currently supports only the User type. If you omit the type, Redpanda assumes the User type by default. With this command, you can assign the role to multiple principals at the same time by using a comma separator between each principal.

There are two ways to add a role to a principal:

Option 1, using the Edit Role view:

  1. Select Security from the left navigation menu.

  2. Select the Roles tab.

  3. Find the role you want to assign to one or more principals and then click on the role name.

  4. Click Edit.

  5. Below the list of permissions, find the Principals section. You can add any number of principals to the role at a time.

  6. After you have listed all new principals, click Update.

Option 2, using the Edit User view:

  1. Select Security from the left navigation menu.

  2. Select the Users tab.

  3. Find the user you want to assign one or more roles to then click the user’s name.

  4. Using the Assign Roles input field, list the roles you want to add to this user.

  5. After you have added all roles, click Update.

Unassign a role

You can remove a role assignment from a security principal without deleting the role. Principals are referred to using the format: Type:Name. Redpanda currently supports only the User type. If you omit the type, Redpanda assumes the User type by default. With this command, you can remove the role from multiple principals at the same time by using a comma separator between each principal.

There are two ways to remove a role from a principal:

Option 1, using the Edit Role view:

  1. Select Security from the left navigation menu.

  2. Select the Roles tab.

  3. Find the role you want to remove from one or more principals and then click on the role name.

  4. Click Edit.

  5. Below the list of permissions, find the Principals section. Click x beside the name of any principals you want to remove from the role.

  6. After you have removed all needed principals, click Update.

Option 2, using the Edit User view:

  1. Select Security from the left navigation menu.

  2. Select the Users tab.

  3. Find the user you want to remove from one or more roles and then click the user’s name.

  4. Click x beside the name of any roles you want to remove this user from.

  5. After you have removed the user from all roles, click Update.

Edit role permissions

You can add or remove ACLs from any of the roles you have previously created.

To edit the ACLs for an existing role:

  1. Select Security from the left navigation menu.

  2. Select the Roles tab.

  3. Find the role you want to assign to one or more principals and then click on the role name.

  4. Click Edit.

  5. In the Edit Role view, you can update the optional origin host for users to connect from.

  6. You can add or remove existing (ACLs) for the role. As when creating a new role, you can create or modify ACLs for topics, consumer groups, and transactional IDs.

  7. After making all changes, click Update.

List all roles

Redpanda lets you view a list of all existing roles.

To view all existing roles:

  1. Select Security from the left navigation menu.

  2. Select the Roles tab.

All roles are listed in a paginated view. You can also filter the view using the input field at the top of the list.

Describe a role

When managing roles, you may need to review the ACLs the role grants or the list of principals assigned to the role.

To view details of an existing role:

  1. Select Security from the left navigation menu.

  2. Select the Roles tab.

  3. Find the role you want to view and click the role name.

All roles are listed in a paginated view. You can also filter the view using the input field at the top of the list.