Confluent - Administrator for Apache Kafka Study Guide

2: Apache Kafka Security

This chapter covers the four cluster-side controls that protect data and access on an Apache Kafka broker: TLS transport encryption, SASL authentication, ACL authorization under the KRaft StandardAuthorizer, and the at-rest options that surround the log directory. It walks through the operator's view of keystores, truststores, listener protocol mapping, SCRAM credential management, ACL precedence, principal mapping, and multi-tenant guardrails, and draws the boundary between what Apache Kafka does natively and what the administrator must arrange at the operating system, identity provider, or application layer.