# Migrating from Role to Attribute-based Access Control

[Grab](https://yomu.fyi/company/grab) · Minh Khoi Nguyen · Mar 9, 2023

**Type:** Problem & solution

## Summary

Grab's streaming data platform team migrated the Kafka Control Plane from Role-Based Access Control to Attribute-Based Access Control to eliminate operational bottlenecks and manual permission management. The previous model required defining hundreds of roles, permissions, and group mappings in an internal IAM service, leading to approval delays and stale memberships. Under the new architecture, user attributes sync from the HRMS and token payloads, while resource attributes are tagged upon creation or backfilled to reflect department and team ownership. Open Policy Agent evaluates access requests defined in Rego via middleware by comparing user attributes with resource metadata. This transition eliminated over 200 roles, 200 permissions, and roughly 3,000 unused IAM resources while automating access provisioning for new joiners.

## Context

Grab's Kafka Control Plane relied on an IAM service using Role-Based Access Control, which caused permission request backlogs for new hires, periodic role renewal delays, stale group memberships, and high debugging overhead across hundreds of roles and resources.

## Approach / What changed

Migrated the Kafka Control Plane to Attribute-Based Access Control by synchronizing user attributes from HRMS into IAM tokens, tagging new and backfilled resources by department and team, and using Open Policy Agent with Rego rules in middleware to evaluate authorization decisions.

## Takeaways

- Open Policy Agent evaluates access in middleware by matching user attributes extracted from IAM tokens against resource metadata tags.
- Transitioning from RBAC to ABAC eliminated over 200 roles, 200 permissions, and nearly 3,000 unused resources from the IAM service.
- Unidentified legacy resources were tagged to a lost-and-found status so service teams could reclaim them when management permissions were required.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [Authentication](https://yomu.fyi/topic/authentication), [Kafka](https://yomu.fyi/topic/kafka), [Migrations](https://yomu.fyi/topic/migration), [Streaming](https://yomu.fyi/topic/streaming)

[Read original post](https://engineering.grab.com/migrating-to-abac)