Migrating from Role to Attribute-based Access Control

Summary

Grab's streaming data platform team migrated the Kafka Control Plane from Role-Based Access Control to Attribute-Based Access Control to eliminate operational bottlenecks and manual permission management. The previous model required defining hundreds of roles, permissions, and group mappings in an internal IAM service, leading to approval delays and stale memberships. Under the new architecture, user attributes sync from the HRMS and token payloads, while resource attributes are tagged upon creation or backfilled to reflect department and team ownership. Open Policy Agent evaluates access requests defined in Rego via middleware by comparing user attributes with resource metadata. This transition eliminated over 200 roles, 200 permissions, and roughly 3,000 unused IAM resources while automating access provisioning for new joiners.

Takeaways

1. 1

   Open Policy Agent evaluates access in middleware by matching user attributes extracted from IAM tokens against resource metadata tags.

2. 2

   Transitioning from RBAC to ABAC eliminated over 200 roles, 200 permissions, and nearly 3,000 unused resources from the IAM service.

3. 3

   Unidentified legacy resources were tagged to a lost-and-found status so service teams could reclaim them when management permissions were required.