Topic deletion is disabled. error http 409, AKHQ v0.26.0

[matikepa]

HI
I'm seeing a popup in the top-right corner that says "Topic deletion is disabled." every time I am trying to remove topic.
However, I have verified that I possess all necessary permissions both within the application and through IAM.

helm chart: akhq/akhq
version: 0.26.0
AWS MSK standard

Any ideas why is that ?

AKHQ log warn

 WARN  io-executor-thread-2 org.akhq.log.access [Date: 2025-09-10T13:38:05.678939211Z] [Duration: 2 ms] [Url: DELETE /api/playground/topic/removeme] [Status: 409] [Ip: /10.0.0.244] [User: my@user] [Length: 147]

AKHQ config

configuration:
  akhq:
    groups:
      admin:
        attributes:
          topics-filter-regexp: .*
        name: UIAdmin
        roles:
          - resources: [ "NODE" ]
            actions: [ "READ", "READ_CONFIG", "ALTER_CONFIG" ]
          - resources: [ "TOPIC" ]
            actions: [ "READ","READ_CONFIG", "CREATE", "DELETE", "UPDATE", "ALTER_CONFIG" ]
          - resources: [ "TOPIC_DATA" ]
            actions: [ "READ", "CREATE", "DELETE" ]
          - resources: [ "CONNECTOR" ]
            actions: [ "READ", "CREATE", "UPDATE_STATE", "DELETE" ]
          - resources: [ "SCHEMA" ]
            actions: [ "READ", "CREATE", "UPDATE", "DELETE", "DELETE_VERSION" ]
          - resources: [ "CONSUMER_GROUP" ]
            actions: [ "READ" ]
          - resources: [ "CONNECT_CLUSTER" ]
            actions: [ "READ" ]
          - resources: [ "KSQLDB" ]
            actions: [ "READ", "EXECUTE" ]

 --- OR
configuration:
  akhq:
    groups:
      admin:
        attributes:
          topics-filter-regexp: .*
        name: UIAdmin
        roles:
        - topic/read
        - topic/create
        - topic/insert
        - topic/delete
        - topic/config/update
        - topic/data/read
        - topic/data/insert
        - topic/data/delete
        - node/read
        - node/config/update
        - group/read
        - group/delete
        - group/offsets/update
        - registry/read
        - registry/insert
        - registry/update
        - registry/delete
        - registry/version/delete
        - acls/read
        - acls/update
        - acls/create
        - acls/delete
        - connect/read
        - connect/insert
        - connect/update
        - connect/delete
        - connect/state/update

IAM/IRSA config

{
    "Statement": [
        {
            "Action": [
                "kafka-cluster:AlterCluster",
                "kafka-cluster:AlterGroup",
                "kafka-cluster:AlterTopic",
                "kafka-cluster:Connect",
                "kafka-cluster:CreateClusterSnapshot",
                "kafka-cluster:CreateGroup",
                "kafka-cluster:CreateTopic",
                "kafka-cluster:DeleteGroup",
                "kafka-cluster:DescribeCluster",
                "kafka-cluster:DescribeClusterDynamicConfiguration",
                "kafka-cluster:DescribeGroup",
                "kafka-cluster:DescribeTopicDynamicConfiguration",
                "kafka-cluster:DescribeTransactionalId",
                "kafka-cluster:ReadData",
                "kafka-cluster:RestoreClusterFromSnapshot",
                "kafka-cluster:UpdateClusterConfiguration",
                "kafka-cluster:UpdateClusterKafkaVersion",
                "kafka-cluster:WriteData",
                "kafka-cluster:DescribeTopic",
                "kafka-cluster:DeleteTopic",
                "kafka-cluster:WriteDataIdempotently",
                "kafka-cluster:AlterTransactionalId",
                "kafka-cluster:AlterTopicDynamicConfiguration",
                "kafka-cluster:AlterClusterDynamicConfiguration"
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:kafka:eu-central-1:<awsID>:cluster/*/*",
                "arn:aws:kafka:eu-central-1:<awsID>:topic/*/*",
                "arn:aws:kafka:eu-central-1:<awsID>:group/*/*"
            ]
        }
    ],
    "Version": "2012-10-17"
}

[matikepa]

• The screen of mentioned popup

• Additionally, the jwt signature is also set
  micronaut.security.token.jwt.signatures.secret.generator.secret: ${randValue}

[matikepa]

okay solved

the solution is to set the IAC/TF with below config for configuration_properties on "delete.topic.enable"= "true"