# Admin ClusterAuthorizationException **URL:** \ **Category:** Confluent Cloud\ **Created:** [11 May 2021 17:03 UTC](https://forum.confluent.io/t/admin-clusterauthorizationexception/1738 "2021-05-11T17:03:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![cs-jackb](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/cs-jackb/32/768_2.png) [@cs-jackb](https://forum.confluent.io/u/cs-jackb)\ **Post date:** [11 May 2021 17:03 UTC](https://forum.confluent.io/t/admin-clusterauthorizationexception/1738/1 "2021-05-11T17:03:57Z")
Looking for suggestions regarding possible Cluster ACL issues. On our Confluent Cloud tenant, we have a service account with an associated API key that we are using with the Kafka tools. This service account has the following Cluster ACLs: ``` (principal=User:######, host=*, operation=DESCRIBE_CONFIGS, permissionType=ALLOW) (principal=User:######, host=*, operation=ALTER_CONFIGS, permissionType=ALLOW) (principal=User:######, host=*, operation=CLUSTER_ACTION, permissionType=ALLOW) (principal=User:######, host=*, operation=ALTER, permissionType=ALLOW) (principal=User:######, host=*, operation=DESCRIBE, permissionType=ALLOW) (principal=User:######, host=*, operation=CREATE, permissionType=ALLOW) (principal=User:######, host=*, operation=IDEMPOTENT_WRITE, permissionType=ALLOW) ``` And has been granted the _EnvironmentAdmin_ role for the environment and the _CloudClusterAdmin_ role for the cluster. When using this key (or even my own key), the following command results in a ClusterAuthorizationException. ``` kafka-log-dirs.sh --bootstrap-server $BROKER --command-config /tmp/config.properties --describe --topic-list $TOPIC Exception in thread "main" java.util.concurrent.ExecutionException: org.apache.kafka.common.errors.ClusterAuthorizationException: Cluster authorization failed. at org.apache.kafka.common.internals.KafkaFutureImpl.wrapAndThrow(KafkaFutureImpl.java:45) at org.apache.kafka.common.internals.KafkaFutureImpl.access$000(KafkaFutureImpl.java:32) at org.apache.kafka.common.internals.KafkaFutureImpl$SingleWaiter.await(KafkaFutureImpl.java:89) at org.apache.kafka.common.internals.KafkaFutureImpl.get(KafkaFutureImpl.java:260) at kafka.admin.LogDirsCommand$.describe(LogDirsCommand.scala:50) at kafka.admin.LogDirsCommand$.main(LogDirsCommand.scala:36) at kafka.admin.LogDirsCommand.main(LogDirsCommand.scala) Caused by: org.apache.kafka.common.errors.ClusterAuthorizationException: Cluster authorization failed. ``` Any thoughts as to what is missing to be able to use this portion of the Kafka Admin tools? ---
**Author:** ![rick](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/rick/32/49_2.png) [@rick](https://forum.confluent.io/u/rick)\ **Post date:** [11 May 2021 18:16 UTC](https://forum.confluent.io/t/admin-clusterauthorizationexception/1738/2 "2021-05-11T18:16:58Z")
@cs-jackb just to confirm, the config works for alternative admin tools, like `kafka-topics` ? ---
**Author:** ![rick](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/rick/32/49_2.png) [@rick](https://forum.confluent.io/u/rick)\ **Post date:** [11 May 2021 18:36 UTC](https://forum.confluent.io/t/admin-clusterauthorizationexception/1738/3 "2021-05-11T18:36:31Z")
@cs-jackb If I undestand correctly, and as you’ve observed, this command is not authorized to be executed against Confluent Cloud clusters. Some implementation details and cluster operations are not exposed with the service. ---
**Author:** ![cs-jackb](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/cs-jackb/32/768_2.png) [@cs-jackb](https://forum.confluent.io/u/cs-jackb)\ **Post date:** [11 May 2021 18:41 UTC](https://forum.confluent.io/t/admin-clusterauthorizationexception/1738/4 "2021-05-11T18:41:01Z")
That’s correct, @rick ---
**Author:** ![cs-jackb](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/cs-jackb/32/768_2.png) [@cs-jackb](https://forum.confluent.io/u/cs-jackb)\ **Post date:** [11 May 2021 18:41 UTC](https://forum.confluent.io/t/admin-clusterauthorizationexception/1738/5 "2021-05-11T18:41:55Z")
@rick - Do you happen to know if there’s a list of such operations that are not exposed? ---
**Author:** ![rick](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/rick/32/49_2.png) [@rick](https://forum.confluent.io/u/rick)\ **Post date:** [11 May 2021 18:48 UTC](https://forum.confluent.io/t/admin-clusterauthorizationexception/1738/6 "2021-05-11T18:48:27Z")
Sorry @cs-jackb, i’ve done some searching and cannot locate such a list. There is a lot of exciting work coming around REST APIs, which I believe is going to be the preferred mode of operation for control plane operations against Confluent Cloud. I hope we will see some exciting public information on that in the near future. ---
**Author:** ![cs-jackb](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/cs-jackb/32/768_2.png) [@cs-jackb](https://forum.confluent.io/u/cs-jackb)\ **Post date:** [11 May 2021 18:50 UTC](https://forum.confluent.io/t/admin-clusterauthorizationexception/1738/7 "2021-05-11T18:50:35Z")
Thanks for the response, @rick. It’s a shame these tools aren’t usable, but I look forward to learning more about these upcoming REST APIs. ---
**Author:** ![rick](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.confluent.io/rick/32/49_2.png) [@rick](https://forum.confluent.io/u/rick)\ **Post date:** [11 May 2021 18:51 UTC](https://forum.confluent.io/t/admin-clusterauthorizationexception/1738/8 "2021-05-11T18:51:59Z")
I understand. If you consider a fully managed service, especially the multi-tenant versions of it, some operations just don’t make sense. If I understand correctly, the log dirs details would be nonsensical in a fully managed multi-tenant version of Kafka.