.TH "GCLOUD_MANAGED\-KAFKA_ACLS_CREATE" 1



.SH "NAME"
.HP
gcloud managed\-kafka acls create \- create a Managed Service for Apache Kafka acl



.SH "SYNOPSIS"
.HP
\f5gcloud managed\-kafka acls create\fR (\fIACL\fR\ :\ \fB\-\-cluster\fR=\fICLUSTER\fR\ \fB\-\-location\fR=\fILOCATION\fR) (\fB\-\-acl\-entries\-from\-file\fR=\fIPATH_TO_FILE\fR\ |\ \fB\-\-acl\-entry\fR=[\fIhost\fR=\fIHOST\fR],[\fIoperation\fR=\fIOPERATION\fR],[\fIpermission\-type\fR=\fIPERMISSION\-TYPE\fR],[\fIprincipal\fR=\fIPRINCIPAL\fR]) [\fIGCLOUD_WIDE_FLAG\ ...\fR]



.SH "DESCRIPTION"

Create a Managed Service for Apache Kafka acl.



.SH "EXAMPLES"

To create an acl for the Kafka cluster resource pattern (acl ID = cluster), in a
cluster named mycluster located in us\-central1, run the following:

.RS 2m
$ gcloud managed\-kafka acls create cluster \-\-cluster=mycluster \e
  \-\-location=us\-central1 \e
  \-\-acl\-entry=principal='User:admin@project.iam.gserviceaccount.co\e
m',operation=ALL,permission\-type=ALLOW,host='*' \e
    \-\-acl\-entry=principal='User:reader@project.iam.gserviceaccount.c\e
om',operation=DESCRIBE,permission\-type=ALLOW,host='*' \e
    \-\-acl\-entry=principal='User:reader@project.iam.gserviceaccount.c\e
om',operation=DESCRIBE_CONFIGS,permission\-type=ALLOW,host='*'
.RE

This acl grants an "admin" service account access to ALL cluster\-level
operations, and grants a "reader" service account access to cluster\-level
DESCRIBE and DESCRIBE_CONFIGS operations.



.SH "POSITIONAL ARGUMENTS"

.RS 2m
.TP 2m

Acl resource \- Identifies the name of the acl that this command creates.

The structure of the acl ID defines the Resource Pattern for which the acl
entries apply in the Kafka cluster. The acl ID must be structured like one of
the following:

.RS 2m
For acls on the cluster:
  cluster
.RE

.RS 2m
For acls on a single resource within the cluster:
  topic/{resource_name}
  consumerGroup/{resource_name}
  transactionalId/{resource_name}
.RE

.RS 2m
For acls on all resources that match a prefix:
  topicPrefixed/{resource_name}
  consumerGroupPrefixed/{resource_name}
  transactionalIdPrefixed/{resource_name}
.RE

.RS 2m
For acls on all resources of a given type (i.e. the wildcard literal "*"):
  allTopics (represents topic/*)
  allConsumerGroups (represents consumerGroup/*)
  allTransactionalIds (represents transactionalId/*)
The arguments in this group can be used to specify the attributes of this resource. (NOTE) Some attributes are not given arguments in this group but can be set in other ways.
.RE

To set the \f5project\fR attribute:
.RS 2m
.IP "\(em" 2m
provide the argument \f5acl\fR on the command line with a fully specified name;
.IP "\(em" 2m
provide the argument \f5\-\-project\fR on the command line;
.IP "\(em" 2m
set the property \f5core/project\fR.
.RE
.sp

This must be specified.


.RS 2m
.TP 2m
\fIACL\fR

ID of the acl or fully qualified identifier for the acl.

To set the \f5acl\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5acl\fR on the command line.
.RE
.sp

This positional argument must be specified if any of the other arguments in this
group are specified.

.TP 2m
\fB\-\-cluster\fR=\fICLUSTER\fR

The cluster name.


To set the \f5cluster\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5acl\fR on the command line with a fully specified name;
.IP "\(bu" 2m
provide the argument \f5\-\-cluster\fR on the command line.
.RE
.sp

.TP 2m
\fB\-\-location\fR=\fILOCATION\fR

ID of the location of the Managed Service for Apache Kafka resource. See
https://cloud.google.com/managed\-service\-for\-apache\-kafka/docs/locations for
a list of supported locations.


To set the \f5location\fR attribute:
.RS 2m
.IP "\(bu" 2m
provide the argument \f5acl\fR on the command line with a fully specified name;
.IP "\(bu" 2m
provide the argument \f5\-\-location\fR on the command line.
.RE
.sp


.RE
.RE
.sp

.SH "REQUIRED FLAGS"

.RS 2m
.TP 2m

Exactly one of these must be specified:


.RS 2m
.TP 2m
\fB\-\-acl\-entries\-from\-file\fR=\fIPATH_TO_FILE\fR

Path to a JSON or YAML file containing the acl entries to use in the acl. Use a
full or relative path to a local file containing the value of acl_entries.

.TP 2m
\fB\-\-acl\-entry\fR=[\fIhost\fR=\fIHOST\fR],[\fIoperation\fR=\fIOPERATION\fR],[\fIpermission\-type\fR=\fIPERMISSION\-TYPE\fR],[\fIprincipal\fR=\fIPRINCIPAL\fR]

An acl entry that configures access for a principal, for a specific operation on
the acl's resource pattern. This flag can be repeated.

\f5\fIPRINCIPAL\fR\fR is the principal. Specified as Google Cloud account, with
the Kafka StandardAuthorizer prefix "User:". For example:
"User:admin@project.iam.gserviceaccount.com". Can be the wildcard "User:\f5*\fR"
to refer to all users.

\f5\fIOPERATION\fR\fR is the operation type. Allowed values are: ALL, READ,
WRITE, CREATE, DELETE, ALTER, DESCRIBE, CLUSTER_ACTION, DESCRIBE_CONFIGS,
ALTER_CONFIGS, IDEMPOTENT_WRITE.

\f5\fIPERMISSION\-TYPE\fR\fR is the permission type. Allowed values are: ALLOW,
DENY.

\f5\fIHOST\fR\fR is the host. Must be set to "\f5*\fR" for Managed Service for
Apache Kafka.

Example acl\-entry:
"principal=User:admin@project.iam.gserviceaccount.com,operation=ALL,permission\-type=ALLOW,host=\f5*\fR"


.RE
.RE
.sp

.SH "GCLOUD WIDE FLAGS"

These flags are available to all commands: \-\-access\-token\-file, \-\-account,
\-\-billing\-project, \-\-configuration, \-\-flags\-file, \-\-flatten,
\-\-format, \-\-help, \-\-impersonate\-service\-account, \-\-log\-http,
\-\-project, \-\-quiet, \-\-trace\-token, \-\-user\-output\-enabled,
\-\-verbosity.

Run \fB$ gcloud help\fR for details.



.SH "API REFERENCE"

This command uses the \fBmanagedkafka/v1\fR API. The full documentation for this
API can be found at:
https://cloud.google.com/managed\-service\-for\-apache\-kafka/docs



.SH "NOTES"

These variants are also available:

.RS 2m
$ gcloud alpha managed\-kafka acls create
.RE

.RS 2m
$ gcloud beta managed\-kafka acls create
.RE