Migrating from Role to Attribute-based Access Control

Summary

Grab's streaming data platform team migrated the Kafka Control Plane from Role-Based Access Control to Attribute-Based Access Control to eliminate operational bottlenecks and manual permission management. The previous model required defining hundreds of roles, permissions, and group mappings in an internal IAM service, leading to approval delays and stale memberships. Under the new architecture, user attributes sync from the HRMS and token payloads, while resource attributes are tagged upon creation or backfilled to reflect department and team ownership. Open Policy Agent evaluates access requests defined in Rego via middleware by comparing user attributes with resource metadata. This transition eliminated over 200 roles, 200 permissions, and roughly 3,000 unused IAM resources while automating access provisioning for new joiners.

Context

Grab's Kafka Control Plane relied on an IAM service using Role-Based Access Control, which caused permission request backlogs for new hires, periodic role renewal delays, stale group memberships, and high debugging overhead across hundreds of roles and resources.

Approach / What changed

Migrated the Kafka Control Plane to Attribute-Based Access Control by synchronizing user attributes from HRMS into IAM tokens, tagging new and backfilled resources by department and team, and using Open Policy Agent with Rego rules in middleware to evaluate authorization decisions.

Takeaways

• Open Policy Agent evaluates access in middleware by matching user attributes extracted from IAM tokens against resource metadata tags.
• Transitioning from RBAC to ABAC eliminated over 200 roles, 200 permissions, and nearly 3,000 unused resources from the IAM service.
• Unidentified legacy resources were tagged to a lost-and-found status so service teams could reclaim them when management permissions were required.

Related reading

• Grab · Nov 30, 2023

  An elegant platform

  Grab’s Coban real-time data streaming team initially relied on direct Terraform merge requests for managing self-served resources like Kafka topics and CDC pipelines. This pure Infrastructure-as-Code workflow faced challenges with CI pipeline failures from manual errors, security risks from lacking access controls, and platform team review bottlenecks. To resolve this, Coban implemented a three-tier control plane comprising the Coban UI, a Go backend named Heimdall, and a Git storage and provisioner repository named Khone. Heimdall translates user form submissions into validated merge requests containing Terraform and metadata files, polling Khone's CI status and alerting users. This architecture abstracts infrastructure code behind a graphical self-service portal while preserving underlying Git auditing and automation.

  Fabrice Harbulot

• Grab · Oct 11, 2023

  Scaling marketing for merchants with targeted and intelligent promos

  Grab previously relied on globally assigned, heuristic promotional campaigns where all users could redeem offers until limits were reached. This lack of targeting and customisation failed to optimize promo spending or meet specific merchant business objectives. To solve this, the engineering team built Bullseye, an automated AI-driven promotional assignment system that customises and assigns offers to consumers. The architecture integrates an operations user interface, backend services, Amazon S3 storage, and Spark jobs executing a suite of predictive modules including eater segmentation, campaign impact simulation, and customer response modeling. Since deploying Bullseye in 2021, the system has increased food campaign sales while decreasing promo spend across food and Mart campaigns.

  Sharon Teng

• Grab · Dec 14, 2023

  Sliding window rate limits in distributed systems

  Marketing communications across Grab's user base risked causing notification overload and consent revocations. To enforce personalized daily and weekly frequency caps across more than 270 million users, the team addressed segment membership storage and communication rate limiting. They adopted roaring bitmaps instead of Bloom filters to compactly store user segment data without hash collisions or costly rebuilds upon deletion. For frequency capping, they chose Amazon ElastiCache for Redis over DynamoDB, executing a sliding log rate limiting algorithm directly on the cluster using Lua scripts and sorted sets. Timestamps are stored as sorted set scores, and historical data is cleaned up via eviction ranges to prevent unbounded memory growth.

  Naveen Kumar Jakuva Premkumar

• Grab · Feb 23, 2024

  Enabling near real-time data analytics on the data lake

  Traditional data lake setups using Parquet on Hive metastores struggle with frequent updates and long pipeline intervals, introducing significant latency for ad hoc queries. Grab solved this by implementing Apache Hudi to support near real-time analytics across bounded relational databases and unbounded Kafka streams. For high-throughput sources, Flink streams Avro log files to Merge On Read tables and generates compaction plans for asynchronous Spark writers. Low-throughput workloads leverage Copy On Write tables, while relational database sources ingest binlogs via Flink Change Data Capture connectors. This architecture reduced analytics data latency to the minute level without overloading production databases and Kafka clusters.

  Shi Kai Ng