pulumi-kafka 3.9.0a1736849387__py3-none-any.whl → 3.13.0a1763619276__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. pulumi_kafka/__init__.py +4 -1
  2. pulumi_kafka/_utilities.py +9 -5
  3. pulumi_kafka/acl.py +293 -242
  4. pulumi_kafka/config/__init__.py +2 -1
  5. pulumi_kafka/config/__init__.pyi +28 -4
  6. pulumi_kafka/config/vars.py +61 -27
  7. pulumi_kafka/get_topic.py +14 -14
  8. pulumi_kafka/get_topics.py +85 -0
  9. pulumi_kafka/outputs.py +71 -0
  10. pulumi_kafka/provider.py +369 -228
  11. pulumi_kafka/pulumi-plugin.json +1 -1
  12. pulumi_kafka/quota.py +289 -79
  13. pulumi_kafka/topic.py +261 -88
  14. pulumi_kafka/user_scram_credential.py +202 -87
  15. {pulumi_kafka-3.9.0a1736849387.dist-info → pulumi_kafka-3.13.0a1763619276.dist-info}/METADATA +4 -4
  16. pulumi_kafka-3.13.0a1763619276.dist-info/RECORD +19 -0
  17. {pulumi_kafka-3.9.0a1736849387.dist-info → pulumi_kafka-3.13.0a1763619276.dist-info}/WHEEL +1 -1
  18. pulumi_kafka-3.9.0a1736849387.dist-info/RECORD +0 -17
  19. {pulumi_kafka-3.9.0a1736849387.dist-info → pulumi_kafka-3.13.0a1763619276.dist-info}/top_level.txt +0 -0
pulumi_kafka/acl.py CHANGED
@@ -1,8 +1,8 @@
1
1
  # coding=utf-8
2
- # *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
2
+ # *** WARNING: this file was generated by pulumi-language-python. ***
3
3
  # *** Do not edit by hand unless you're certain you know what you are doing! ***
4
4
 
5
- import copy
5
+ import builtins as _builtins
6
6
  import warnings
7
7
  import sys
8
8
  import pulumi
@@ -19,28 +19,16 @@ __all__ = ['AclArgs', 'Acl']
19
19
  @pulumi.input_type
20
20
  class AclArgs:
21
21
  def __init__(__self__, *,
22
- acl_host: pulumi.Input[str],
23
- acl_operation: pulumi.Input[str],
24
- acl_permission_type: pulumi.Input[str],
25
- acl_principal: pulumi.Input[str],
26
- acl_resource_name: pulumi.Input[str],
27
- acl_resource_type: pulumi.Input[str],
28
- resource_pattern_type_filter: Optional[pulumi.Input[str]] = None):
22
+ acl_host: pulumi.Input[_builtins.str],
23
+ acl_operation: pulumi.Input[_builtins.str],
24
+ acl_permission_type: pulumi.Input[_builtins.str],
25
+ acl_principal: pulumi.Input[_builtins.str],
26
+ acl_resource_name: pulumi.Input[_builtins.str],
27
+ acl_resource_type: pulumi.Input[_builtins.str],
28
+ resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None):
29
29
  """
30
30
  The set of arguments for constructing a Acl resource.
31
- :param pulumi.Input[str] acl_host: Host from which principal listed in `acl_principal`
32
- will have access.
33
- :param pulumi.Input[str] acl_operation: Operation that is being allowed or denied. Valid
34
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
35
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
36
- :param pulumi.Input[str] acl_permission_type: Type of permission. Valid values are `Unknown`,
37
- `Any`, `Allow`, `Deny`.
38
- :param pulumi.Input[str] acl_principal: Principal that is being allowed or denied.
39
- :param pulumi.Input[str] acl_resource_name: The name of the resource.
40
- :param pulumi.Input[str] acl_resource_type: The type of resource. Valid values are `Unknown`,
41
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
42
- :param pulumi.Input[str] resource_pattern_type_filter: The pattern filter. Valid values
43
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
31
+ :param pulumi.Input[_builtins.str] acl_resource_name: The name of the resource
44
32
  """
45
33
  pulumi.set(__self__, "acl_host", acl_host)
46
34
  pulumi.set(__self__, "acl_operation", acl_operation)
@@ -51,122 +39,86 @@ class AclArgs:
51
39
  if resource_pattern_type_filter is not None:
52
40
  pulumi.set(__self__, "resource_pattern_type_filter", resource_pattern_type_filter)
53
41
 
54
- @property
42
+ @_builtins.property
55
43
  @pulumi.getter(name="aclHost")
56
- def acl_host(self) -> pulumi.Input[str]:
57
- """
58
- Host from which principal listed in `acl_principal`
59
- will have access.
60
- """
44
+ def acl_host(self) -> pulumi.Input[_builtins.str]:
61
45
  return pulumi.get(self, "acl_host")
62
46
 
63
47
  @acl_host.setter
64
- def acl_host(self, value: pulumi.Input[str]):
48
+ def acl_host(self, value: pulumi.Input[_builtins.str]):
65
49
  pulumi.set(self, "acl_host", value)
66
50
 
67
- @property
51
+ @_builtins.property
68
52
  @pulumi.getter(name="aclOperation")
69
- def acl_operation(self) -> pulumi.Input[str]:
70
- """
71
- Operation that is being allowed or denied. Valid
72
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
73
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
74
- """
53
+ def acl_operation(self) -> pulumi.Input[_builtins.str]:
75
54
  return pulumi.get(self, "acl_operation")
76
55
 
77
56
  @acl_operation.setter
78
- def acl_operation(self, value: pulumi.Input[str]):
57
+ def acl_operation(self, value: pulumi.Input[_builtins.str]):
79
58
  pulumi.set(self, "acl_operation", value)
80
59
 
81
- @property
60
+ @_builtins.property
82
61
  @pulumi.getter(name="aclPermissionType")
83
- def acl_permission_type(self) -> pulumi.Input[str]:
84
- """
85
- Type of permission. Valid values are `Unknown`,
86
- `Any`, `Allow`, `Deny`.
87
- """
62
+ def acl_permission_type(self) -> pulumi.Input[_builtins.str]:
88
63
  return pulumi.get(self, "acl_permission_type")
89
64
 
90
65
  @acl_permission_type.setter
91
- def acl_permission_type(self, value: pulumi.Input[str]):
66
+ def acl_permission_type(self, value: pulumi.Input[_builtins.str]):
92
67
  pulumi.set(self, "acl_permission_type", value)
93
68
 
94
- @property
69
+ @_builtins.property
95
70
  @pulumi.getter(name="aclPrincipal")
96
- def acl_principal(self) -> pulumi.Input[str]:
97
- """
98
- Principal that is being allowed or denied.
99
- """
71
+ def acl_principal(self) -> pulumi.Input[_builtins.str]:
100
72
  return pulumi.get(self, "acl_principal")
101
73
 
102
74
  @acl_principal.setter
103
- def acl_principal(self, value: pulumi.Input[str]):
75
+ def acl_principal(self, value: pulumi.Input[_builtins.str]):
104
76
  pulumi.set(self, "acl_principal", value)
105
77
 
106
- @property
78
+ @_builtins.property
107
79
  @pulumi.getter(name="aclResourceName")
108
- def acl_resource_name(self) -> pulumi.Input[str]:
80
+ def acl_resource_name(self) -> pulumi.Input[_builtins.str]:
109
81
  """
110
- The name of the resource.
82
+ The name of the resource
111
83
  """
112
84
  return pulumi.get(self, "acl_resource_name")
113
85
 
114
86
  @acl_resource_name.setter
115
- def acl_resource_name(self, value: pulumi.Input[str]):
87
+ def acl_resource_name(self, value: pulumi.Input[_builtins.str]):
116
88
  pulumi.set(self, "acl_resource_name", value)
117
89
 
118
- @property
90
+ @_builtins.property
119
91
  @pulumi.getter(name="aclResourceType")
120
- def acl_resource_type(self) -> pulumi.Input[str]:
121
- """
122
- The type of resource. Valid values are `Unknown`,
123
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
124
- """
92
+ def acl_resource_type(self) -> pulumi.Input[_builtins.str]:
125
93
  return pulumi.get(self, "acl_resource_type")
126
94
 
127
95
  @acl_resource_type.setter
128
- def acl_resource_type(self, value: pulumi.Input[str]):
96
+ def acl_resource_type(self, value: pulumi.Input[_builtins.str]):
129
97
  pulumi.set(self, "acl_resource_type", value)
130
98
 
131
- @property
99
+ @_builtins.property
132
100
  @pulumi.getter(name="resourcePatternTypeFilter")
133
- def resource_pattern_type_filter(self) -> Optional[pulumi.Input[str]]:
134
- """
135
- The pattern filter. Valid values
136
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
137
- """
101
+ def resource_pattern_type_filter(self) -> Optional[pulumi.Input[_builtins.str]]:
138
102
  return pulumi.get(self, "resource_pattern_type_filter")
139
103
 
140
104
  @resource_pattern_type_filter.setter
141
- def resource_pattern_type_filter(self, value: Optional[pulumi.Input[str]]):
105
+ def resource_pattern_type_filter(self, value: Optional[pulumi.Input[_builtins.str]]):
142
106
  pulumi.set(self, "resource_pattern_type_filter", value)
143
107
 
144
108
 
145
109
  @pulumi.input_type
146
110
  class _AclState:
147
111
  def __init__(__self__, *,
148
- acl_host: Optional[pulumi.Input[str]] = None,
149
- acl_operation: Optional[pulumi.Input[str]] = None,
150
- acl_permission_type: Optional[pulumi.Input[str]] = None,
151
- acl_principal: Optional[pulumi.Input[str]] = None,
152
- acl_resource_name: Optional[pulumi.Input[str]] = None,
153
- acl_resource_type: Optional[pulumi.Input[str]] = None,
154
- resource_pattern_type_filter: Optional[pulumi.Input[str]] = None):
112
+ acl_host: Optional[pulumi.Input[_builtins.str]] = None,
113
+ acl_operation: Optional[pulumi.Input[_builtins.str]] = None,
114
+ acl_permission_type: Optional[pulumi.Input[_builtins.str]] = None,
115
+ acl_principal: Optional[pulumi.Input[_builtins.str]] = None,
116
+ acl_resource_name: Optional[pulumi.Input[_builtins.str]] = None,
117
+ acl_resource_type: Optional[pulumi.Input[_builtins.str]] = None,
118
+ resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None):
155
119
  """
156
120
  Input properties used for looking up and filtering Acl resources.
157
- :param pulumi.Input[str] acl_host: Host from which principal listed in `acl_principal`
158
- will have access.
159
- :param pulumi.Input[str] acl_operation: Operation that is being allowed or denied. Valid
160
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
161
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
162
- :param pulumi.Input[str] acl_permission_type: Type of permission. Valid values are `Unknown`,
163
- `Any`, `Allow`, `Deny`.
164
- :param pulumi.Input[str] acl_principal: Principal that is being allowed or denied.
165
- :param pulumi.Input[str] acl_resource_name: The name of the resource.
166
- :param pulumi.Input[str] acl_resource_type: The type of resource. Valid values are `Unknown`,
167
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
168
- :param pulumi.Input[str] resource_pattern_type_filter: The pattern filter. Valid values
169
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
121
+ :param pulumi.Input[_builtins.str] acl_resource_name: The name of the resource
170
122
  """
171
123
  if acl_host is not None:
172
124
  pulumi.set(__self__, "acl_host", acl_host)
@@ -183,156 +135,206 @@ class _AclState:
183
135
  if resource_pattern_type_filter is not None:
184
136
  pulumi.set(__self__, "resource_pattern_type_filter", resource_pattern_type_filter)
185
137
 
186
- @property
138
+ @_builtins.property
187
139
  @pulumi.getter(name="aclHost")
188
- def acl_host(self) -> Optional[pulumi.Input[str]]:
189
- """
190
- Host from which principal listed in `acl_principal`
191
- will have access.
192
- """
140
+ def acl_host(self) -> Optional[pulumi.Input[_builtins.str]]:
193
141
  return pulumi.get(self, "acl_host")
194
142
 
195
143
  @acl_host.setter
196
- def acl_host(self, value: Optional[pulumi.Input[str]]):
144
+ def acl_host(self, value: Optional[pulumi.Input[_builtins.str]]):
197
145
  pulumi.set(self, "acl_host", value)
198
146
 
199
- @property
147
+ @_builtins.property
200
148
  @pulumi.getter(name="aclOperation")
201
- def acl_operation(self) -> Optional[pulumi.Input[str]]:
202
- """
203
- Operation that is being allowed or denied. Valid
204
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
205
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
206
- """
149
+ def acl_operation(self) -> Optional[pulumi.Input[_builtins.str]]:
207
150
  return pulumi.get(self, "acl_operation")
208
151
 
209
152
  @acl_operation.setter
210
- def acl_operation(self, value: Optional[pulumi.Input[str]]):
153
+ def acl_operation(self, value: Optional[pulumi.Input[_builtins.str]]):
211
154
  pulumi.set(self, "acl_operation", value)
212
155
 
213
- @property
156
+ @_builtins.property
214
157
  @pulumi.getter(name="aclPermissionType")
215
- def acl_permission_type(self) -> Optional[pulumi.Input[str]]:
216
- """
217
- Type of permission. Valid values are `Unknown`,
218
- `Any`, `Allow`, `Deny`.
219
- """
158
+ def acl_permission_type(self) -> Optional[pulumi.Input[_builtins.str]]:
220
159
  return pulumi.get(self, "acl_permission_type")
221
160
 
222
161
  @acl_permission_type.setter
223
- def acl_permission_type(self, value: Optional[pulumi.Input[str]]):
162
+ def acl_permission_type(self, value: Optional[pulumi.Input[_builtins.str]]):
224
163
  pulumi.set(self, "acl_permission_type", value)
225
164
 
226
- @property
165
+ @_builtins.property
227
166
  @pulumi.getter(name="aclPrincipal")
228
- def acl_principal(self) -> Optional[pulumi.Input[str]]:
229
- """
230
- Principal that is being allowed or denied.
231
- """
167
+ def acl_principal(self) -> Optional[pulumi.Input[_builtins.str]]:
232
168
  return pulumi.get(self, "acl_principal")
233
169
 
234
170
  @acl_principal.setter
235
- def acl_principal(self, value: Optional[pulumi.Input[str]]):
171
+ def acl_principal(self, value: Optional[pulumi.Input[_builtins.str]]):
236
172
  pulumi.set(self, "acl_principal", value)
237
173
 
238
- @property
174
+ @_builtins.property
239
175
  @pulumi.getter(name="aclResourceName")
240
- def acl_resource_name(self) -> Optional[pulumi.Input[str]]:
176
+ def acl_resource_name(self) -> Optional[pulumi.Input[_builtins.str]]:
241
177
  """
242
- The name of the resource.
178
+ The name of the resource
243
179
  """
244
180
  return pulumi.get(self, "acl_resource_name")
245
181
 
246
182
  @acl_resource_name.setter
247
- def acl_resource_name(self, value: Optional[pulumi.Input[str]]):
183
+ def acl_resource_name(self, value: Optional[pulumi.Input[_builtins.str]]):
248
184
  pulumi.set(self, "acl_resource_name", value)
249
185
 
250
- @property
186
+ @_builtins.property
251
187
  @pulumi.getter(name="aclResourceType")
252
- def acl_resource_type(self) -> Optional[pulumi.Input[str]]:
253
- """
254
- The type of resource. Valid values are `Unknown`,
255
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
256
- """
188
+ def acl_resource_type(self) -> Optional[pulumi.Input[_builtins.str]]:
257
189
  return pulumi.get(self, "acl_resource_type")
258
190
 
259
191
  @acl_resource_type.setter
260
- def acl_resource_type(self, value: Optional[pulumi.Input[str]]):
192
+ def acl_resource_type(self, value: Optional[pulumi.Input[_builtins.str]]):
261
193
  pulumi.set(self, "acl_resource_type", value)
262
194
 
263
- @property
195
+ @_builtins.property
264
196
  @pulumi.getter(name="resourcePatternTypeFilter")
265
- def resource_pattern_type_filter(self) -> Optional[pulumi.Input[str]]:
266
- """
267
- The pattern filter. Valid values
268
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
269
- """
197
+ def resource_pattern_type_filter(self) -> Optional[pulumi.Input[_builtins.str]]:
270
198
  return pulumi.get(self, "resource_pattern_type_filter")
271
199
 
272
200
  @resource_pattern_type_filter.setter
273
- def resource_pattern_type_filter(self, value: Optional[pulumi.Input[str]]):
201
+ def resource_pattern_type_filter(self, value: Optional[pulumi.Input[_builtins.str]]):
274
202
  pulumi.set(self, "resource_pattern_type_filter", value)
275
203
 
276
204
 
205
+ @pulumi.type_token("kafka:index/acl:Acl")
277
206
  class Acl(pulumi.CustomResource):
278
207
  @overload
279
208
  def __init__(__self__,
280
209
  resource_name: str,
281
210
  opts: Optional[pulumi.ResourceOptions] = None,
282
- acl_host: Optional[pulumi.Input[str]] = None,
283
- acl_operation: Optional[pulumi.Input[str]] = None,
284
- acl_permission_type: Optional[pulumi.Input[str]] = None,
285
- acl_principal: Optional[pulumi.Input[str]] = None,
286
- acl_resource_name: Optional[pulumi.Input[str]] = None,
287
- acl_resource_type: Optional[pulumi.Input[str]] = None,
288
- resource_pattern_type_filter: Optional[pulumi.Input[str]] = None,
211
+ acl_host: Optional[pulumi.Input[_builtins.str]] = None,
212
+ acl_operation: Optional[pulumi.Input[_builtins.str]] = None,
213
+ acl_permission_type: Optional[pulumi.Input[_builtins.str]] = None,
214
+ acl_principal: Optional[pulumi.Input[_builtins.str]] = None,
215
+ acl_resource_name: Optional[pulumi.Input[_builtins.str]] = None,
216
+ acl_resource_type: Optional[pulumi.Input[_builtins.str]] = None,
217
+ resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None,
289
218
  __props__=None):
290
219
  """
291
- A resource for managing Kafka ACLs.
220
+ The `Acl` resource manages Apache Kafka Access Control Lists (ACLs). ACLs control access to Kafka resources like topics, consumer groups, and clusters by defining which principals (users or services) can perform specific operations on these resources.
292
221
 
293
222
  ## Example Usage
294
223
 
224
+ ### Allow Producer Access to Topic
225
+
295
226
  ```python
296
227
  import pulumi
297
228
  import pulumi_kafka as kafka
298
229
 
299
- test = kafka.Acl("test",
300
- acl_resource_name="syslog",
230
+ producer = kafka.Acl("producer",
231
+ acl_resource_name="orders",
301
232
  acl_resource_type="Topic",
302
- acl_principal="User:Alice",
233
+ acl_principal="User:producer-service",
303
234
  acl_host="*",
304
235
  acl_operation="Write",
305
- acl_permission_type="Deny")
236
+ acl_permission_type="Allow")
237
+ # Also grant describe permission for producers
238
+ producer_describe = kafka.Acl("producer_describe",
239
+ acl_resource_name="orders",
240
+ acl_resource_type="Topic",
241
+ acl_principal="User:producer-service",
242
+ acl_host="*",
243
+ acl_operation="Describe",
244
+ acl_permission_type="Allow")
306
245
  ```
307
246
 
308
- ## Import
247
+ ### Allow Consumer Group Access
309
248
 
310
- ACLs can be imported using the following pattern
249
+ ```python
250
+ import pulumi
251
+ import pulumi_kafka as kafka
311
252
 
312
- ```sh
313
- $ pulumi import kafka:index/acl:Acl test "acl_principal|acl_host|acl_operation|acl_permission_type|resource_type|resource_name|resource_pattern_type_filter"
253
+ # Allow read access to topic
254
+ consumer_read = kafka.Acl("consumer_read",
255
+ acl_resource_name="orders",
256
+ acl_resource_type="Topic",
257
+ acl_principal="User:consumer-service",
258
+ acl_host="*",
259
+ acl_operation="Read",
260
+ acl_permission_type="Allow")
261
+ # Allow access to consumer group
262
+ consumer_group = kafka.Acl("consumer_group",
263
+ acl_resource_name="order-processors",
264
+ acl_resource_type="Group",
265
+ acl_principal="User:consumer-service",
266
+ acl_host="*",
267
+ acl_operation="Read",
268
+ acl_permission_type="Allow")
314
269
  ```
315
- e.g.
270
+
271
+ ### Prefix-Based Access Control
272
+
273
+ ```python
274
+ import pulumi
275
+ import pulumi_kafka as kafka
276
+
277
+ # Grant access to all topics with prefix "logs-"
278
+ logs_access = kafka.Acl("logs_access",
279
+ acl_resource_name="logs-",
280
+ acl_resource_type="Topic",
281
+ resource_pattern_type_filter="Prefixed",
282
+ acl_principal="User:log-aggregator",
283
+ acl_host="*",
284
+ acl_operation="Read",
285
+ acl_permission_type="Allow")
286
+ ```
287
+
288
+ ### Admin User with Full Access
289
+
290
+ ```python
291
+ import pulumi
292
+ import pulumi_kafka as kafka
293
+
294
+ # Grant cluster-level admin access
295
+ admin_cluster = kafka.Acl("admin_cluster",
296
+ acl_resource_name="kafka-cluster",
297
+ acl_resource_type="Cluster",
298
+ acl_principal="User:admin",
299
+ acl_host="*",
300
+ acl_operation="All",
301
+ acl_permission_type="Allow")
302
+ ```
303
+
304
+ ## Common ACL Patterns
305
+
306
+ ### Producer ACLs
307
+ Producers typically need:
308
+ - `Write` and `Describe` on topics
309
+ - `Write` on `TransactionalID` (for transactional producers)
310
+ - `IdempotentWrite` on `Cluster` (for idempotent producers)
311
+
312
+ ### Consumer ACLs
313
+ Consumers typically need:
314
+ - `Read` on topics
315
+ - `Read` on consumer groups
316
+ - `Describe` on topics (optional, for metadata)
317
+
318
+ ### Admin ACLs
319
+ Administrators typically need:
320
+ - `All` on `Cluster`
321
+ - Or specific operations like `Alter`, `AlterConfigs`, `Create`, `Delete`
322
+
323
+ > **Warning:** Be cautious with `Deny` ACLs as they take precedence over `Allow` ACLs. A deny rule will block access even if an allow rule exists.
324
+
325
+ ## Import
326
+
327
+ Kafka ACLs can be imported using a pipe-delimited string containing all ACL properties:
328
+
329
+ Format: ${acl_principal}|${acl_host}|${acl_operation}|${acl_permission_type}|${resource_type}|${resource_name}|${resource_pattern_type_filter}
316
330
 
317
331
  ```sh
318
- $ pulumi import kafka:index/acl:Acl test "User:Alice|*|Write|Deny|Topic|syslog|Prefixed"
332
+ $ pulumi import kafka:index/acl:Acl example 'User:producer|*|Write|Allow|Topic|orders|Literal'
319
333
  ```
320
334
 
321
335
  :param str resource_name: The name of the resource.
322
336
  :param pulumi.ResourceOptions opts: Options for the resource.
323
- :param pulumi.Input[str] acl_host: Host from which principal listed in `acl_principal`
324
- will have access.
325
- :param pulumi.Input[str] acl_operation: Operation that is being allowed or denied. Valid
326
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
327
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
328
- :param pulumi.Input[str] acl_permission_type: Type of permission. Valid values are `Unknown`,
329
- `Any`, `Allow`, `Deny`.
330
- :param pulumi.Input[str] acl_principal: Principal that is being allowed or denied.
331
- :param pulumi.Input[str] acl_resource_name: The name of the resource.
332
- :param pulumi.Input[str] acl_resource_type: The type of resource. Valid values are `Unknown`,
333
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
334
- :param pulumi.Input[str] resource_pattern_type_filter: The pattern filter. Valid values
335
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
337
+ :param pulumi.Input[_builtins.str] acl_resource_name: The name of the resource
336
338
  """
337
339
  ...
338
340
  @overload
@@ -341,34 +343,119 @@ class Acl(pulumi.CustomResource):
341
343
  args: AclArgs,
342
344
  opts: Optional[pulumi.ResourceOptions] = None):
343
345
  """
344
- A resource for managing Kafka ACLs.
346
+ The `Acl` resource manages Apache Kafka Access Control Lists (ACLs). ACLs control access to Kafka resources like topics, consumer groups, and clusters by defining which principals (users or services) can perform specific operations on these resources.
345
347
 
346
348
  ## Example Usage
347
349
 
350
+ ### Allow Producer Access to Topic
351
+
348
352
  ```python
349
353
  import pulumi
350
354
  import pulumi_kafka as kafka
351
355
 
352
- test = kafka.Acl("test",
353
- acl_resource_name="syslog",
356
+ producer = kafka.Acl("producer",
357
+ acl_resource_name="orders",
354
358
  acl_resource_type="Topic",
355
- acl_principal="User:Alice",
359
+ acl_principal="User:producer-service",
356
360
  acl_host="*",
357
361
  acl_operation="Write",
358
- acl_permission_type="Deny")
362
+ acl_permission_type="Allow")
363
+ # Also grant describe permission for producers
364
+ producer_describe = kafka.Acl("producer_describe",
365
+ acl_resource_name="orders",
366
+ acl_resource_type="Topic",
367
+ acl_principal="User:producer-service",
368
+ acl_host="*",
369
+ acl_operation="Describe",
370
+ acl_permission_type="Allow")
359
371
  ```
360
372
 
361
- ## Import
373
+ ### Allow Consumer Group Access
362
374
 
363
- ACLs can be imported using the following pattern
375
+ ```python
376
+ import pulumi
377
+ import pulumi_kafka as kafka
364
378
 
365
- ```sh
366
- $ pulumi import kafka:index/acl:Acl test "acl_principal|acl_host|acl_operation|acl_permission_type|resource_type|resource_name|resource_pattern_type_filter"
379
+ # Allow read access to topic
380
+ consumer_read = kafka.Acl("consumer_read",
381
+ acl_resource_name="orders",
382
+ acl_resource_type="Topic",
383
+ acl_principal="User:consumer-service",
384
+ acl_host="*",
385
+ acl_operation="Read",
386
+ acl_permission_type="Allow")
387
+ # Allow access to consumer group
388
+ consumer_group = kafka.Acl("consumer_group",
389
+ acl_resource_name="order-processors",
390
+ acl_resource_type="Group",
391
+ acl_principal="User:consumer-service",
392
+ acl_host="*",
393
+ acl_operation="Read",
394
+ acl_permission_type="Allow")
395
+ ```
396
+
397
+ ### Prefix-Based Access Control
398
+
399
+ ```python
400
+ import pulumi
401
+ import pulumi_kafka as kafka
402
+
403
+ # Grant access to all topics with prefix "logs-"
404
+ logs_access = kafka.Acl("logs_access",
405
+ acl_resource_name="logs-",
406
+ acl_resource_type="Topic",
407
+ resource_pattern_type_filter="Prefixed",
408
+ acl_principal="User:log-aggregator",
409
+ acl_host="*",
410
+ acl_operation="Read",
411
+ acl_permission_type="Allow")
367
412
  ```
368
- e.g.
413
+
414
+ ### Admin User with Full Access
415
+
416
+ ```python
417
+ import pulumi
418
+ import pulumi_kafka as kafka
419
+
420
+ # Grant cluster-level admin access
421
+ admin_cluster = kafka.Acl("admin_cluster",
422
+ acl_resource_name="kafka-cluster",
423
+ acl_resource_type="Cluster",
424
+ acl_principal="User:admin",
425
+ acl_host="*",
426
+ acl_operation="All",
427
+ acl_permission_type="Allow")
428
+ ```
429
+
430
+ ## Common ACL Patterns
431
+
432
+ ### Producer ACLs
433
+ Producers typically need:
434
+ - `Write` and `Describe` on topics
435
+ - `Write` on `TransactionalID` (for transactional producers)
436
+ - `IdempotentWrite` on `Cluster` (for idempotent producers)
437
+
438
+ ### Consumer ACLs
439
+ Consumers typically need:
440
+ - `Read` on topics
441
+ - `Read` on consumer groups
442
+ - `Describe` on topics (optional, for metadata)
443
+
444
+ ### Admin ACLs
445
+ Administrators typically need:
446
+ - `All` on `Cluster`
447
+ - Or specific operations like `Alter`, `AlterConfigs`, `Create`, `Delete`
448
+
449
+ > **Warning:** Be cautious with `Deny` ACLs as they take precedence over `Allow` ACLs. A deny rule will block access even if an allow rule exists.
450
+
451
+ ## Import
452
+
453
+ Kafka ACLs can be imported using a pipe-delimited string containing all ACL properties:
454
+
455
+ Format: ${acl_principal}|${acl_host}|${acl_operation}|${acl_permission_type}|${resource_type}|${resource_name}|${resource_pattern_type_filter}
369
456
 
370
457
  ```sh
371
- $ pulumi import kafka:index/acl:Acl test "User:Alice|*|Write|Deny|Topic|syslog|Prefixed"
458
+ $ pulumi import kafka:index/acl:Acl example 'User:producer|*|Write|Allow|Topic|orders|Literal'
372
459
  ```
373
460
 
374
461
  :param str resource_name: The name of the resource.
@@ -386,13 +473,13 @@ class Acl(pulumi.CustomResource):
386
473
  def _internal_init(__self__,
387
474
  resource_name: str,
388
475
  opts: Optional[pulumi.ResourceOptions] = None,
389
- acl_host: Optional[pulumi.Input[str]] = None,
390
- acl_operation: Optional[pulumi.Input[str]] = None,
391
- acl_permission_type: Optional[pulumi.Input[str]] = None,
392
- acl_principal: Optional[pulumi.Input[str]] = None,
393
- acl_resource_name: Optional[pulumi.Input[str]] = None,
394
- acl_resource_type: Optional[pulumi.Input[str]] = None,
395
- resource_pattern_type_filter: Optional[pulumi.Input[str]] = None,
476
+ acl_host: Optional[pulumi.Input[_builtins.str]] = None,
477
+ acl_operation: Optional[pulumi.Input[_builtins.str]] = None,
478
+ acl_permission_type: Optional[pulumi.Input[_builtins.str]] = None,
479
+ acl_principal: Optional[pulumi.Input[_builtins.str]] = None,
480
+ acl_resource_name: Optional[pulumi.Input[_builtins.str]] = None,
481
+ acl_resource_type: Optional[pulumi.Input[_builtins.str]] = None,
482
+ resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None,
396
483
  __props__=None):
397
484
  opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
398
485
  if not isinstance(opts, pulumi.ResourceOptions):
@@ -431,13 +518,13 @@ class Acl(pulumi.CustomResource):
431
518
  def get(resource_name: str,
432
519
  id: pulumi.Input[str],
433
520
  opts: Optional[pulumi.ResourceOptions] = None,
434
- acl_host: Optional[pulumi.Input[str]] = None,
435
- acl_operation: Optional[pulumi.Input[str]] = None,
436
- acl_permission_type: Optional[pulumi.Input[str]] = None,
437
- acl_principal: Optional[pulumi.Input[str]] = None,
438
- acl_resource_name: Optional[pulumi.Input[str]] = None,
439
- acl_resource_type: Optional[pulumi.Input[str]] = None,
440
- resource_pattern_type_filter: Optional[pulumi.Input[str]] = None) -> 'Acl':
521
+ acl_host: Optional[pulumi.Input[_builtins.str]] = None,
522
+ acl_operation: Optional[pulumi.Input[_builtins.str]] = None,
523
+ acl_permission_type: Optional[pulumi.Input[_builtins.str]] = None,
524
+ acl_principal: Optional[pulumi.Input[_builtins.str]] = None,
525
+ acl_resource_name: Optional[pulumi.Input[_builtins.str]] = None,
526
+ acl_resource_type: Optional[pulumi.Input[_builtins.str]] = None,
527
+ resource_pattern_type_filter: Optional[pulumi.Input[_builtins.str]] = None) -> 'Acl':
441
528
  """
442
529
  Get an existing Acl resource's state with the given name, id, and optional extra
443
530
  properties used to qualify the lookup.
@@ -445,19 +532,7 @@ class Acl(pulumi.CustomResource):
445
532
  :param str resource_name: The unique name of the resulting resource.
446
533
  :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
447
534
  :param pulumi.ResourceOptions opts: Options for the resource.
448
- :param pulumi.Input[str] acl_host: Host from which principal listed in `acl_principal`
449
- will have access.
450
- :param pulumi.Input[str] acl_operation: Operation that is being allowed or denied. Valid
451
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
452
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
453
- :param pulumi.Input[str] acl_permission_type: Type of permission. Valid values are `Unknown`,
454
- `Any`, `Allow`, `Deny`.
455
- :param pulumi.Input[str] acl_principal: Principal that is being allowed or denied.
456
- :param pulumi.Input[str] acl_resource_name: The name of the resource.
457
- :param pulumi.Input[str] acl_resource_type: The type of resource. Valid values are `Unknown`,
458
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
459
- :param pulumi.Input[str] resource_pattern_type_filter: The pattern filter. Valid values
460
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
535
+ :param pulumi.Input[_builtins.str] acl_resource_name: The name of the resource
461
536
  """
462
537
  opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
463
538
 
@@ -472,65 +547,41 @@ class Acl(pulumi.CustomResource):
472
547
  __props__.__dict__["resource_pattern_type_filter"] = resource_pattern_type_filter
473
548
  return Acl(resource_name, opts=opts, __props__=__props__)
474
549
 
475
- @property
550
+ @_builtins.property
476
551
  @pulumi.getter(name="aclHost")
477
- def acl_host(self) -> pulumi.Output[str]:
478
- """
479
- Host from which principal listed in `acl_principal`
480
- will have access.
481
- """
552
+ def acl_host(self) -> pulumi.Output[_builtins.str]:
482
553
  return pulumi.get(self, "acl_host")
483
554
 
484
- @property
555
+ @_builtins.property
485
556
  @pulumi.getter(name="aclOperation")
486
- def acl_operation(self) -> pulumi.Output[str]:
487
- """
488
- Operation that is being allowed or denied. Valid
489
- values are `Unknown`, `Any`, `All`, `Read`, `Write`, `Create`, `Delete`, `Alter`,
490
- `Describe`, `ClusterAction`, `DescribeConfigs`, `AlterConfigs`, `IdempotentWrite`.
491
- """
557
+ def acl_operation(self) -> pulumi.Output[_builtins.str]:
492
558
  return pulumi.get(self, "acl_operation")
493
559
 
494
- @property
560
+ @_builtins.property
495
561
  @pulumi.getter(name="aclPermissionType")
496
- def acl_permission_type(self) -> pulumi.Output[str]:
497
- """
498
- Type of permission. Valid values are `Unknown`,
499
- `Any`, `Allow`, `Deny`.
500
- """
562
+ def acl_permission_type(self) -> pulumi.Output[_builtins.str]:
501
563
  return pulumi.get(self, "acl_permission_type")
502
564
 
503
- @property
565
+ @_builtins.property
504
566
  @pulumi.getter(name="aclPrincipal")
505
- def acl_principal(self) -> pulumi.Output[str]:
506
- """
507
- Principal that is being allowed or denied.
508
- """
567
+ def acl_principal(self) -> pulumi.Output[_builtins.str]:
509
568
  return pulumi.get(self, "acl_principal")
510
569
 
511
- @property
570
+ @_builtins.property
512
571
  @pulumi.getter(name="aclResourceName")
513
- def acl_resource_name(self) -> pulumi.Output[str]:
572
+ def acl_resource_name(self) -> pulumi.Output[_builtins.str]:
514
573
  """
515
- The name of the resource.
574
+ The name of the resource
516
575
  """
517
576
  return pulumi.get(self, "acl_resource_name")
518
577
 
519
- @property
578
+ @_builtins.property
520
579
  @pulumi.getter(name="aclResourceType")
521
- def acl_resource_type(self) -> pulumi.Output[str]:
522
- """
523
- The type of resource. Valid values are `Unknown`,
524
- `Any`, `Topic`, `Group`, `Cluster`, `TransactionalID`.
525
- """
580
+ def acl_resource_type(self) -> pulumi.Output[_builtins.str]:
526
581
  return pulumi.get(self, "acl_resource_type")
527
582
 
528
- @property
583
+ @_builtins.property
529
584
  @pulumi.getter(name="resourcePatternTypeFilter")
530
- def resource_pattern_type_filter(self) -> pulumi.Output[Optional[str]]:
531
- """
532
- The pattern filter. Valid values
533
- are `Prefixed`, `Any`, `Match`, `Literal`. Default `Literal`.
534
- """
585
+ def resource_pattern_type_filter(self) -> pulumi.Output[Optional[_builtins.str]]:
535
586
  return pulumi.get(self, "resource_pattern_type_filter")
536
587