Where are Apache Kafka Access Control Lists stored'?

In traditional Apache Kafka deployments, which rely on ZooKeeper for cluster coordination, Access Control Lists (ACLs) are stored as metadata within ZooKeeper. ZooKeeper serves as the authoritative source of truth for the cluster's configuration, including security policies. Kafka brokers connect to ZooKeeper, read the ACLs, and cache them in memory to enforce authorization for client requests efficiently. While newer Kafka versions can run in KRaft mode without ZooKeeper, storing ACLs in ZooKeeper is the standard mechanism in the widely deployed architecture covered by the CCAAK exam.

A. Broker: In a ZooKeeper-based cluster, brokers only cache ACLs for performance; they do not persistently store them. ZooKeeper is the source of truth.

C. Schema Registry: This is a separate Confluent component for managing data schemas and has its own security model, but it does not store Kafka broker ACLs.

D. Connect: This is a framework for integrating Kafka with external systems and is not responsible for storing core cluster security metadata like ACLs.

1. Confluent Documentation, "Authorization using ACLs": "The out-of-box authorizer implementation that ships with Kafka stores ACLs in ZooKeeper. The Kafka brokers read the ACLs from ZooKeeper and cache them." (Reference: Confluent Documentation > Security > Authorization (ACLs) > Adding, Removing, and Listing ACLs section).

2. Apache Kafka Documentation, "Security - Authorization": "Kafka ships with a pluggable Authorizer. The default implementation is AclAuthorizer (kafka.security.authorizer.AclAuthorizer)... It stores ACLs in ZooKeeper." (Reference: Apache Kafka Documentation > Version 3.7 > Security > Section 3.3 Authorization).

3. Kreps, J., Narkhede, N., & Rao, J. (2011). Kafka: A Distributed Messaging System for Log Processing. While this foundational paper predates the full ACL implementation, it establishes ZooKeeper's central role for "managing consumption and cluster metadata" which is the architectural pattern that storing ACLs follows. (Reference: Proceedings of the NetDB'11 Workshop, Section 2.3. ZooKeeper Coordination).