Skip to main content
Top
Review meshIQ Products (G2.com)

Topic Permissions in RabbitMQ Server

Some of the content described in this article is available in meshIQ Manage versions 12.1 and greater.
For a quick overview of what's new or changed, visit the meshIQ Highlights page for a version-by-version breakdown.  

Jump to Section:
Version 12.x and Later
Version 11.3 and Earlier

Version 12.x and Later

Topic permissions in RabbitMQ control how a specific user can interact with exchanges within a virtual host. They define which routing keys a user is allowed to read from or write to, enabling fine-grained, topic-based access control. This is especially useful in environments where different applications or services must publish or consume only certain categories of messages.

Topic permissions are evaluated using pattern matching on routing keys.

Write Permission
Indicates whether the user is allowed to publish messages to the selected exchange.
If set to yes, publishing is permitted; if set to no, the user is not allowed to publish.

Read Permission
Indicates whether the user is allowed to consume messages routed through the exchange.
If set to yes, the user can receive messages; if set to no, the user cannot consume from queues bound to that exchange.

View Topic Permissions

To view topic permissions on a RabbitMQ server:

  1. Open the Server widget and select the server you want to inspect.

  2. From the Selected menu, choose Permissions > Topic.

  3. A permissions tab opens in the console showing all topic permissions configured on the server, including the associated virtual host, user, exchange, and the read/write patterns. To add new permissions, see the section below.

Add Topic Permissions

To add topic permissions:

  1. While viewing Topic Permissions in the console, click Add Permission .
    The RabbitMQ Server Topic Permission dialog opens.

  2. In the Topic Permission dialog, select the following from the dropdowns:

    • Virtual Host – The vhost where the permission applies.

    • User Name – The user to grant or update permissions for.

    • Exchange – The exchange for which the topic permissions are being defined.

  3. Specify Yes or No for the permission fields:

    • Read – Determines whether the user is allowed to consume messages routed through this exchange.

    • Write – Determines whether the user is allowed to publish messages to this exchange.
      Routing-key patterns may include wildcards (* and #) based on AMQP topic exchange rules. See below for details.

  4. Click Ok to apply the configuration immediately, or click Schedule to apply it at a later time.

What happens if Read or Write is set to * or #?

RabbitMQ interprets these symbols using AMQP topic-exchange wildcard rules:

* (single-word wildcard)

  • Matches exactly one word in a routing key.

  • Example:

    • Pattern sensor.* matches sensor.temp or sensor.humidity.

    • Does NOT match sensor.temp.indoor.

# (multi-word wildcard)

  • Matches zero or more words in a routing key.

  • Example:

    • Pattern sensor.# matches sensor.temp, sensor.temp.indoor, and sensor.

Modify Topic Permissions

  1. While viewing Topic Permissions in the console, select the permission entry and click Edit from the Selected menu.

  2. The RabbitMQ Server Global Parameters dialog opens.

  3. Update the Read or Write fields as needed, then click Ok to save the changes immediately, or click Schedule to apply them at a later time.

Delete Topic Permissions

  1. While viewing Topic Permissions in the console, select the permission entry and click Delete from the Selected menu.

  2. The Confirm Delete Action dialog opens. 

  3. Click Yes to delete the permission immediately, or click Schedule to perform the deletion later.

______________________________________________________________________________________________________________

Version 11.3 and Earlier

Topic permissions in RabbitMQ control how a specific user can interact with exchanges within a virtual host. They define which routing keys a user is allowed to read from or write to, enabling fine-grained, topic-based access control. This is especially useful in environments where different applications or services must publish or consume only certain categories of messages.

Topic permissions are evaluated using pattern matching on routing keys.

Write Permission
Indicates whether the user is allowed to publish messages to the selected exchange.
If set to yes, publishing is permitted; if set to no, the user is not allowed to publish.

Read Permission
Indicates whether the user is allowed to consume messages routed through the exchange.
If set to yes, the user can receive messages; if set to no, the user cannot consume from queues bound to that exchange.

View Topic Permissions

To view topic permissions on a RabbitMQ server:

  1. Open the Server viewlet and select the server you want to inspect.

  2. From the Selected menu, choose Permissions > Topic.

  3. A permissions tab opens in the console showing all topic permissions configured on the server, including the associated virtual host, user, exchange, and the read/write patterns. To add new permissions, see the section below.

Add Topic Permissions

To add topic permissions:

  1. While viewing Topic Permissions in the console, click Add Permission .
    The RabbitMQ Server Topic Permission dialog opens.

  2. In the Topic Permission dialog, select the following from the dropdowns:

    • Virtual Host – The vhost where the permission applies.

    • User Name – The user to grant or update permissions for.

    • Exchange – The exchange for which the topic permissions are being defined.

  3. Specify Yes or No for the permission fields:

    • Read – Determines whether the user is allowed to consume messages routed through this exchange.

    • Write – Determines whether the user is allowed to publish messages to this exchange.
      Routing-key patterns may include wildcards (* and #) based on AMQP topic exchange rules. See below for details.

  4. Click Ok to apply the configuration immediately, or click Schedule to apply it at a later time.

What happens if Read or Write is set to * or #?

RabbitMQ interprets these symbols using AMQP topic-exchange wildcard rules:

* (single-word wildcard)

  • Matches exactly one word in a routing key.

  • Example:

    • Pattern sensor.* matches sensor.temp or sensor.humidity.

    • Does NOT match sensor.temp.indoor.

# (multi-word wildcard)

  • Matches zero or more words in a routing key.

  • Example:

    • Pattern sensor.# matches sensor.temp, sensor.temp.indoor, and sensor.

Modify Topic Permissions

  1. While viewing Topic Permissions in the console, select the permission entry and click Edit from the Selected menu.

  2. The RabbitMQ Server Global Parameters dialog opens.

  3. Update the Read or Write fields as needed, then click Ok to save the changes immediately, or click Schedule to apply them at a later time.

Delete Topic Permissions

  1. While viewing Topic Permissions in the console, select the permission entry and click Delete from the Selected menu.

  2. The Confirm Delete Action dialog opens. 

  3. Click Yes to delete the permission immediately, or click Schedule to perform the deletion later.