| copyright |
|
||
|---|---|---|---|
| lastupdated | 2018-07-04 |
{:new_window: target="_blank"} {:shortdesc: .shortdesc} {:screen: .screen} {:codeblock: .codeblock} {:pre: .pre}
{: #security }
You can secure your {{site.data.keyword.messagehub}} resources in a fine-grained manner to manage the access that you want to grant each user to each resource.
Within {{site.data.keyword.messagehub}}, you can secure access to the following resources:
- Cluster (cluster): you can control which applications and users can connect to the service
- Topics (topic): you can control the ability of users and applications to create, delete, read, and write to a topic
- Consumer groups (group): you can control an application's ability to join a consumer group
- Producer transactions (txnid): you can control the ability to use the transactional producer capability in Kafka (that is, single, atomic writes across multiple partitions)
The levels of access (also known as a role) that you can assign to a user to each resource are as follows:
| Access role | Description of actions | Example actions |
|---|---|---|
| Reader | Perform read-only actions within {{site.data.keyword.messagehub}} such as viewing resources | Allow an app to connect to a cluster by assigning read access to cluster resource type |
| Writer | Writers have permissions beyond the reader role, including creating and editing {{site.data.keyword.messagehub}} resources. | Allow an app to produce to topics by assigning write access to topic resource and topic name types |
| Manager | Managers have permissions beyond the writer role to complete privileged actions. In addition, you can create and edit {{site.data.keyword.messagehub}} resources. | Allow full access to all resources by assigning manage access to the {{site.data.keyword.messagehub}} instance |
| {: caption="Table 1. Example {{site.data.keyword.messagehub}} user roles and actions" caption-side="top"} |
Cloud Identity and Access Management (IAM) policies are attached to the resources to be controlled. Each policy defines the level of access that a particular user should have and to which resource or set of resources. A policy consists of the following information:
- The type of service the policy applies to. For example, {{site.data.keyword.messagehub}}. You can scope a policy to include all service types.
- The instance of the service to be secured. You can scope a policy to include all instances of a service type.
- The type of resource to be secured. The valid values are
cluster,topic,group, ortxnid. Specifying a type is optional. If you do not specify a type, the policy then applies to all resources in the service instance. - The resource to be secured. Specify for resources of type
topic,groupandtxnid. If you do not specify the resource, the policy then applies to all resources of the type specified in the service instance. - The role assigned to the user. For example, Reader, Writer, or Manager.
By default, when {{site.data.keyword.messagehub}} is provisioned, the user who provisioned it is granted the manager role to all the instance's resources. Additionally, any user who has a manager role for either 'All' services or 'All' {{site.data.keyword.messagehub}} service instances' in the same account also has full access.
You can then apply additional policies to extend access to other users. You can either scope a policy to apply to {{site.data.keyword.messagehub}} as a whole or to individual resources within {{site.data.keyword.messagehub}}. For more information, see Common scenarios.
Only users with an administration role for an account can assign policies to users . Assign policies either by using IBM Cloud dashboard or by using the ibmcloud commands.
{: #security_scenarios }
This table summarizes some common {{site.data.keyword.messagehub}} scenarios and the access you need to assign:
| Action | Reader role | Writer role | Manager role |
|---------|----------------|
| Allow full access to all resources|Not applicable |Not applicable |Service instance: your_service_instance|
| Allow an app or user to create or delete topic |Resource type: cluster |Not applicable |Resource type: topic
Optional: Resource ID: name_of_topic |
| List groups, topics, and offsets
Describe group, topic, and broker configurations | Resource type: cluster |Not applicable |Not applicable |
| Allow an app to connect to the cluster |Resource type: cluster| Not applicable |Not applicable |
| Allow an app to produce to any topic |Resource type: cluster|Resource type: topic |Not applicable |
| Allow an app to produce to a specific topic |Resource type: cluster|Resource type: topic
Resource ID: name_of_topic |Not applicable |
| Allow an app to connect and consume from any topic (no consumer group) |Resource type: cluster
Resource type: topic |Resource type: topic|Not applicable |
| Allow an app to connect and consume from a specific topic (no consumer group) | Resource type: cluster
Resource type: topic
Resource ID: name_of_topic |Not applicable |Not applicable |
| Allow an app to consume a topic (consumer group) |Resource type: cluster
Resource type: topic
Resource type: group |Not applicable |Not applicable |
| Allow an app to produce to a topic transactionally |Resource type: cluster
Resource type: group|Resource type: topic
Resource ID: name_of_topic
Resource type: txnid |Not applicable |
| Delete consumer group |Resource type: cluster |Not applicable |Resource type: group
Resource ID: group_ID |
| To use Streams |Resource type: cluster
Resouce type: group| Not applicable |Resouce type: topic |
For more information about IAM, see IBM Cloud Identity and Access Management.
For an example of how to set policies, see:
IBM Cloud IAM Service IDs and API Keys 
{:new_window}.
{: #connect_message_enterprise }
For information about how to bind a Cloud Foundry application or get a security key credential for an external application, see Connecting to {{site.data.keyword.messagehub}}.