# rpk security acl create

> For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [streaming-full.txt](https://docs.redpanda.com/streaming-full.txt)

---
title: rpk security acl create
latest-redpanda-tag: v26.2.1
latest-console-tag: v3.10.0
latest-operator-version: v26.2.1
# EOL = End-of-Life (support lifecycle status)
page-is-nearing-eol: "false"
page-is-past-eol: "false"
page-eol-date: July 28, 2027
latest-connect-version: 4.105.0
docname: rpk/rpk-security/rpk-security-acl-create
page-component-name: streaming
page-version: "26.2"
page-component-version: "26.2"
page-component-title: Streaming
page-relative-src-path: rpk/rpk-security/rpk-security-acl-create.adoc
page-edit-url: https://github.com/redpanda-data/docs/edit/main/modules/reference/pages/rpk/rpk-security/rpk-security-acl-create.adoc
description: "Create ACLs. Following the multiplying effect of combining flags, the create command works on a straightforward basis: every ACL combination is a created ACL."
page-git-created-date: "2024-04-30"
page-git-modified-date: "2026-08-03"
support-status: supported
---

<!-- Source: https://docs.redpanda.com/streaming/current/reference/rpk/rpk-security/rpk-security-acl-create.md -->

Create ACLs. Following the multiplying effect of combining flags, the create command works on a straightforward basis: every ACL combination is a created ACL.

If no host is specified, an allowed principal is allowed access from all hosts. The wildcard principal `*` allows all principals. At least one principal, one host, one resource, and one operation is required to create a single ACL.

## [](#usage)Usage

```bash
rpk security acl create [flags]
```

> 📝 **NOTE**
>
> The schema migration examples on this page are Schema Registry ACLs only. You also require Kafka ACLs for topics, consumer groups, and cluster operations. See [Configure Access Control Lists](https://docs.redpanda.com/streaming/current/manage/security/authorization/acl/).

## [](#examples)Examples

This section provides examples of how to use `rpk security acl create`.

### [](#user-acls)User ACLs

Allow all permissions to user bar on topic `foo` and group `g`

```bash
rpk security acl create --allow-principal bar --operation all --topic foo --group g
```

Allow read permissions to all users on topics biz and baz

```bash
rpk security acl create --allow-principal '*' --operation read --topic biz,baz
```

Allow write permissions to user buzz to transactional ID `txn`

```bash
rpk security acl create --allow-principal User:buzz --operation write --transactional-id txn
```

### [](#role-acls)Role ACLs

Allow all permissions to role bar on topic `foo` and group `g`

```bash
rpk security acl create --allow-role bar --operation all --topic foo --group g
```

### [](#schema-registry-acls)Schema Registry ACLs

Allow read permissions to user `panda` on topic `bar` and schema registry subject `bar-value`

```bash
rpk security acl create --allow-principal panda --operation read --topic bar --registry-subject bar-value
```

### [](#schema-migration-permissions)Schema migration permissions

Source cluster (read-only) for schema migration

```bash
rpk security acl create --allow-principal User:migrator-user --operation read,describe --registry-global --brokers <source-brokers>
```

Target cluster (read-write) for schema migration

```bash
rpk security acl create --allow-principal User:migrator-user --operation write,describe,alter_configs,describe_configs --registry-global --brokers <target-brokers>
```

## [](#flags)Flags

| Value | Type | Description |
| --- | --- | --- |
| --allow-host | stringSlice | Hosts from which access will be granted (repeatable). |
| --allow-principal | stringSlice | Principal to allow. Format: User:name or Group:name. Can be specified multiple times. |
| --allow-role | stringSlice | Roles for which these permissions will be granted (repeatable). |
| --cluster | bool | Whether to grant ACLs to the cluster. |
| --deny-host | stringSlice | Hosts from from access will be denied (repeatable). |
| --deny-principal | stringSlice | Principal to deny. Format: User:name or Group:name. Can be specified multiple times. |
| --deny-role | stringSlice | Role for which these permissions will be denied (repeatable). |
| --group | stringSlice | Group to grant ACLs for (repeatable). |
| --operation | stringSlice | Operation to allow or deny: all, read, write, create, delete, alter, describe, clusteraction, describeconfigs, alterconfigs, idempotentwrite. |
| --registry-global | bool | Whether to grant ACLs for the schema registry. |
| --registry-subject | stringSlice | Schema Registry subjects to grant ACLs for (repeatable). |
| --resource-pattern-type | string | Pattern type: literal (exact match), prefixed (prefix match), match (either literal or prefixed), any. |
| --topic | stringSlice | Topic to grant ACLs for (repeatable). |
| --transactional-id | stringSlice | Transactional IDs to grant ACLs for (repeatable). |

## [](#global-flags)Global flags

| Value | Type | Description |
| --- | --- | --- |
| --config | string | Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml. |
| -X, --config-opt | stringArray | Override rpk configuration settings; -X help for detail or -X list for terser detail. |
| --ignore-profile | bool | Ignore rpk.yaml and redpanda.yaml; use default settings. |
| --profile | string | rpk profile to use. |
| -v, --verbose | bool | Enable verbose logging. |

## [](#suggested-reading)Suggested reading

-   [Configure Access Control Lists](https://docs.redpanda.com/streaming/current/manage/security/authorization/acl/)