Enable External Network Calls from Custom SMTs

Custom Single Message Transformations (SMTs) cannot make external network calls by default. Enable external egress per connector to allow your Custom SMT to call endpoints outside Confluent Cloud, such as key management services (KMS), secret stores, or data enrichment APIs.

Note

External egress for Custom SMTs is a Limited Availability feature in Confluent Cloud, available at no additional cost during this phase.

If you would like to participate in the Limited Availability Program, contact Confluent Support or your Confluent account team to enable external egress for your organization.

Prerequisites

Before enabling external egress, verify that you have:

Custom SMT artifact: A Custom SMT artifact uploaded to your environment. For details, see Configure Custom SMT for Kafka Connectors in Confluent Cloud.
Co-located destination service: The external service must be hosted in the same region as the connector.
PrivateLink Endpoint (AWS): Required only if your Custom SMT must reach a private endpoint. You need an Egress PrivateLink Endpoint on an Egress PrivateLink gateway in the same region as the connector. See Use AWS Egress PrivateLink Endpoints for Serverless Products on Confluent Cloud.

Limitations

For information about limits and constraints, see Custom SMT external egress limitations, including which destinations are reachable for your cloud provider and cluster type.

Enable external egress on a connector

To allow Custom SMTs on a connector to make outbound network calls, set csmt.egress.enable to true in the connector configuration.

Configuration property	Type	Default	Description
`csmt.egress.enable`	Boolean	`false`	Enables outbound network calls for Custom SMTs configured on this connector.

Note

You can configure external egress only through the connector configuration, using the Confluent CLI, the Confluent Cloud REST API, or Terraform. Confluent Cloud Console doesn’t support this property. For the complete list of supported interfaces and other constraints, see Custom SMT external egress reachability.

Create a new connector with egress enabled

Set csmt.egress.enable to true in your connector configuration, with your Custom SMT’s own transform properties. The following example saves a source connector configuration as conn-config.json, with an encryptfield Custom SMT that calls an external KMS:

{
  "connector.class": "DatagenSource",
  "name": "DatagenSourceCustomSmtEgress",
  "kafka.auth.mode": "SERVICE_ACCOUNT",
  "kafka.service.account.id": "<service_account_id>",
  "kafka.topic": "datagen-source-csmt",
  "output.data.format": "JSON",
  "quickstart": "ORDERS",
  "tasks.max": "1",
  "transforms": "encryptfield",
  "transforms.encryptfield.type": "com.example.kafka.connect.smt.EncryptField$Value",
  "transforms.encryptfield.custom.smt.artifact.id": "<custom_smt_artifact_id>",
  "csmt.egress.enable": "true"
}

Create the connector using your configuration file (conn-config.json):

confluent connect cluster create --config-file conn-config.json --cluster <kafka_cluster_id>

Enable egress on an existing connector

To enable external egress on a running connector, update its configuration using the Confluent CLI:

confluent connect cluster update <connector_id> --config csmt.egress.enable=true --cluster <kafka_cluster_id>

Best practices

Set request timeouts: Implement explicit connection and read timeouts within your Custom SMT code. Unresponsive network calls can stall processing and cause connector task failures.
Implement error logging: Add detailed exception logging within the SMT code to simplify network and API troubleshooting.