DAS-C01 · Question #110
A central government organization is collecting events from various internal applications using Amazon Managed Streaming for Apache Kafka (Amazon MSK). The organization has configured a separate…
The correct answer is C. Use Kafka ACLs and configure read and write permissions for each topic. Kafka Access Control Lists (ACLs) are the native Kafka mechanism for authorizing which clients (principals) can read from or write to specific topics. By configuring write ACLs per topic and per application identity, you ensure each application can only write to its designated…
Question
A central government organization is collecting events from various internal applications using Amazon Managed Streaming for Apache Kafka (Amazon MSK). The organization has configured a separate Kafka topic for each application to separate the data. For security reasons, the Kafka cluster has been configured to only allow TLS encrypted data and it encrypts the data at rest. A recent application update showed that one of the applications was configured incorrectly, resulting in writing data to a Kafka topic that belongs to another application. This resulted in multiple errors in the analytics pipeline as data from different applications appeared on the same topic. After this incident, the organization wants to prevent applications from writing to a topic different than the one they should write to. Which solution meets these requirements with the least amount of effort?
Options
- ACreate a different Amazon EC2 security group for each application.
- BInstall Kafka Connect on each application instance and configure each Kafka Connect instance to
- CUse Kafka ACLs and configure read and write permissions for each topic.
- DCreate a different Amazon EC2 security group for each application.
How the community answered
(42 responses)- A2% (1)
- B7% (3)
- C79% (33)
- D12% (5)
Explanation
Kafka Access Control Lists (ACLs) are the native Kafka mechanism for authorizing which clients (principals) can read from or write to specific topics. By configuring write ACLs per topic and per application identity, you ensure each application can only write to its designated topic. EC2 security groups (A, D) operate at the network layer - they can control which instances reach the MSK cluster, but cannot restrict which Kafka topics a connected client is allowed to produce to. Kafka Connect (B) is a data integration framework, not an access control mechanism. ACLs are the correct, purpose-built solution.
Topics
Community Discussion
No community discussion yet for this question.