Get Started with Client Quotas in Confluent Cloud¶

This section shows how to create, list, and delete Confluent Cloud Client Quotas using the Confluent CLI and the Confluent Cloud Console. For the full command reference, see confluent kafka quota. To make similar calls with a REST API, see the Client Quotas Reference.

Prerequisites:

Confluent CLI installed, and access to a Confluent Cloud administrator account.

Sign in to your Confluent Cloud account, and create a Service Account by running the following command:
```
confluent iam service-account create client-quota-SA --description "Client Quotas demo SA"
```

Create a quota, specifying a quota name, the cluster where the quota is applied, values for ingress and egress and the principal ID. Ingress and egress values are specified in bytes. Use values of at least 1 MB (1,000,000 bytes) or higher. Consider the following examples, where the quota name is test-quota.

For example, creating a quota with a service account principal:

confluent kafka quota create test-quota --cluster lkc-12345 \
                            --ingress 1000000 --egress 1000000 --description "Test Quota" \
                            --principals sa-12345

For example, creating a quota with an identity pool principal:

confluent kafka quota create test-quota --cluster lkc-12345 \
                            --ingress 1000000 --egress 1000000 --description "Test Quota" \
                            --principals pool-abcde

For example, creating a quota with identity pool and service account principals:

confluent kafka quota create test-quota --cluster lkc-12345 \
                            --ingress 1000000 --egress 1000000 --description "Test Quota" \
                            --principals pool-abcde sa-12345

The result should look similar to the following:

+--------------+-------------+
| ID           | cq-abcde    |
| Display Name | test-quota  |
| Description  | Test Quota  |
| Ingress      | 1000000 B/s |
| Egress       | 1000000 B/s |
| Cluster      | lkc-12345   |
| Principals   | sa-12345    |
+--------------+-------------+

You can modify your quota later. For example, to add or remove principals, use the update command:

confluent kafka quota update cq-abcde --add-principals sa-12345
confluent kafka quota update cq-abcde --remove-principals sa-12345

Finally, you can retrieve a list of quota IDs with the list command, and use delete to delete the the sample quota you created:
```
confluent kafka quota list --cluster lkc-12345
confluent kafka quota delete cq-abcde --cluster lkc-12345
```

Prerequisites:

Terraform Provider for Confluent installed, and access to a Confluent Cloud administrator account.

To create a quota with Terraform Provider for Confluent use the following snippet of Terraform configuration:

# Configure the Confluent Provider
terraform {
  required_providers {
    confluent = {
      source  = "confluentinc/confluent"
    }
  }
}
provider "confluent" {
  cloud_api_key    = var.confluent_cloud_api_key    # optionally use CONFLUENT_CLOUD_API_KEY env var
  cloud_api_secret = var.confluent_cloud_api_secret # optionally use CONFLUENT_CLOUD_API_SECRET env var
}
...
resource "confluent_kafka_client_quota" "example" {
  display_name = "test-quota"
  description  = "Test Quota"
  throughput {
    ingress_byte_rate = "1000000"
    egress_byte_rate  = "1000000"
  }
  principals = ["sa-12345", "sa-abc456", "pool-xyz111"]
  kafka_cluster {
    id = "lkc-12345"
  }
  environment {
    id = "env-a12b34"
  }
  lifecycle {
    prevent_destroy = true
  }
}
# Create more resources ...

You must provide appropriate Confluent Cloud credentials to use the provider.

For more information about the resources that you can interact with, see the Confluent Terraform Provider documentation in the Terraform registry.

For the full confluent_kafka_client_quota resource reference, see the Confluent Terraform Provider documentation in the Terraform registry.