Topic permissions do not have any effect on the default exchange

[Swierkowski]

I want to limit the access for a given user. I want this user to be able to use only the default exchange. Moreover I want him to use default exchange only with specified routing key.

Setting permission is working as expected. It limits to default exchange.

My expectation is that topic permission will cause the routing key limitation, but it isn't.

I start rabbitmq using docker:
docker run -it --rm --name rabbitmq -p 5672:5672 -p 15672:15672 rabbitmq:3.9-management

My user permissions:

[michaelklishin]

I will convert this issue to a GitHub discussion. Currently GitHub will automatically close and lock the issue even though your question will be transferred and responded to elsewhere. This is to let you know that we do not intend to ignore this but this is how the current GitHub conversion mechanism makes it seem for the users :(

[michaelklishin]

Topic permissions by definition won't apply to the default exchange because, well, it's of type direct. Topic permissions only apply to topic exchanges, and require a topic exchange when declared. There are no permissions for routing keys.

[Swierkowski]

@michaelklishin thanks for your clarification.

It is misleading that when you define topic permission in UI you can choose all kind of exchanges and the first one is the default exchange. Moreover, there is no error when you define topic permission with direct exchange.

[darraghjones]

Does this mean it's not possible to achieve what the OP wants?

[davidmwhynot]

Why not make it possible to add the routing key to the exchange resource permissions checks? You're right that, in most cases, you should just use a topic exchange but if, for some reason, I need to allow a particular user to write to the default exchange that user now has direct write access to every queue because of the implicit binding that exists between all queues and the default exchange.
The only example I can think of right now is an RPC server user that needs to utilize the direct-reply-to functionality.