Confluent Developer Marketplace Get started
  1. Home
  2. Cloud
  3. Manage Billing in Confluent Cloud

Billing for multiple organizations in Confluent Cloud

A parent model groups the Confluent Cloud organizations that belong to your company so that you can share a single commitment.

The capabilities on this page are self-service for customers with a parent commitment for multi-organization billing.

Note

The Confluent Cloud parent model is available as a Limited Availability feature.

If you would like to participate in the Limited Availability Program, contact your Confluent account team to enable the parent model.

View linked organizations

Users with the ParentAdmin role can view the organizations linked to the parent.

To view linked organizations in the Confluent Cloud Console:

  1. Sign in to the Confluent Cloud Console.

  2. In your organization menu, click Parent portal.

  3. On the Overview tab, review the list of organizations linked to your parent.

Note

If you have the ParentAdmin role but Parent portal doesn’t appear in the navigation menu, open a support ticket to request that the parent APIs be enabled for your parent.

To list linked organizations by using the Confluent Cloud REST API, send the following request:

curl -s -u "<CLOUD_API_KEY>:<CLOUD_API_SECRET>" \
  https://api.confluent.cloud/iam/v2/parent-organization-links

The response includes one entry for each linked organization, with its organization_id, organization_name, and parent_id.

View consolidated consumption

Users with the ParentAdmin role can view billing and consumption across all organizations linked to the parent.

To view consolidated consumption in the Confluent Cloud Console:

  1. Sign in to the Confluent Cloud Console.

  2. In the navigation menu, click Parent portal.

  3. Click the Billing tab.

From the Billing tab, you can:

  • View the total drawdown of your parent commitment across all linked organizations.

    Note

    The commitment summary appears only when your parent has an active commitment.

  • Download the invoice for each linked organization.

Manage the ParentAdmin role

The ParentAdmin role grants view access to the parent.

Note

To view and manage the ParentAdmin role, use the Confluent Cloud APIs. The Confluent Cloud Console and Confluent CLI don’t show ParentAdmin role bindings.

The ParentAdmin doesn’t grant permissions within linked organizations, such as access to read data. You can grant ParentAdmin to users, service accounts, SSO group mappings, and identity pools.

Only a principal with the ParentAdmin role can grant ParentAdmin to another principal. An OrganizationAdmin doesn’t grant or have any access to the parent without the additional ParentAdmin role.

If you have an active parent commitment and no one in your organization has the ParentAdmin role, contact Confluent Support.

Prerequisite

  • A Cloud API key or Global API Key owned by a user or service account that has a direct ParentAdmin role binding.

  • Your parent ID.

    To find your parent ID, list the parent organization links:

    curl -s -u "<CLOUD_API_KEY>:<CLOUD_API_SECRET>" \
  https://api.confluent.cloud/iam/v2/parent-organization-links

    The response lists each linked organization and its parent_id:

    {
  "kind": "ParentOrganizationLinkList",
  "data": [
    {
      "id": "pol-xxxxx",
      "parent_id": "p-xxxxx",
      "organization_id": "<ORGANIZATION_ID>",
      "organization_name": "Acme Production"
    }
  ]
}

    Role bindings for the parent use the scope crn://confluent.cloud/parent=<PARENT_ID>.

List role bindings

To list all principals that have a role on the parent, send the following request:

curl -s -G -u "<CLOUD_API_KEY>:<CLOUD_API_SECRET>" \
  https://api.confluent.cloud/iam/v2/role-bindings \
  --data-urlencode "crn_pattern=crn://confluent.cloud/parent=<PARENT_ID>/*"

Example response:

{
  "kind": "RoleBindingList",
  "data": [
    {
      "id": "rb-xxxxx",
      "principal": "User:u-xxxxx",
      "role_name": "ParentAdmin",
      "crn_pattern": "crn://confluent.cloud/parent=p-xxxxx"
    }
  ]
}

principal identifies a user with User:u-xxxxx, service account with User:sa-xxxxx, identity pool with User:pool-xxxxx, or SSO group mapping with User:group-xxxxx.

To filter by principal, add --data-urlencode "principal=User:<USER_ID>".

To get a user’s email address, send a request to GET /iam/v2/users/<USER_ID>.

Grant role binding

To grant the ParentAdmin role to a principal, send the following request:

curl -s -X POST -u "<CLOUD_API_KEY>:<CLOUD_API_SECRET>" \
  https://api.confluent.cloud/iam/v2/role-bindings \
  -H "Content-Type: application/json" \
  -d '{
    "principal": "User:<USER_ID>",
    "role_name": "ParentAdmin",
    "crn_pattern": "crn://confluent.cloud/parent=<PARENT_ID>"
  }'

A successful request returns 201 Created and the ID of the new role binding of rb-xxxxx.

To find a user’s ID with u-xxxxx, send a request to GET /iam/v2/users and match on email.

Remove a role binding

To remove the ParentAdmin role from a principal, delete its role binding. Before you remove a role binding, verify that at least one other principal has the ParentAdmin role. To find the role binding ID, see List role bindings.

To grant the ParentAdmin role to a principal, send the following request:

curl -s -X DELETE -u "<CLOUD_API_KEY>:<CLOUD_API_SECRET>" \
  https://api.confluent.cloud/iam/v2/role-bindings/<ROLE_BINDING_ID>

Limitations

  • A parent supports a maximum of ten linked organizations.

  • All organizations linked to a parent must use the same billing method, directly by Confluent or through a cloud marketplace.

Related content