Is it possible to have different topic permissions?

[tunix]

Hi,

It seems possible to define multiple permissions for topics but the widest permission seems to be applied at the moment. An example:

          - resource: topic
            value: ".*"
            actions:
              - view
              - messages_read

          - resource: topic
            value: "__amazon_msk_.*"
            actions: [ view ]

I'd like readonly users to read messages in topics but not some internal topics. I thought maybe the permissions are read with an order so tried both ways but it doesn't seem to work.

I guess my only option for now is to either fully remove messages_read or use field masking/removal feature?

Will we ever be able to define multiple permissions per resource?

[Haarolean]

Yeah the way it works is combining all the entries. But the value is a regex, so you can specify something like ^(?!__amazon_msk_.*$).* instead.