# Manage Client-Side Encryption for Fully Managed Connectors in Confluent Cloud You can enable [client-side field level encryption (CSFLE)](../security/encrypt/csfle/overview.md#client-side-field-level-encryption) or [client-side payload encryption (CSPE)](../security/encrypt/cspe.md#use-client-side-payload-encryption) to make your data more secure on fully managed connectors. CSFLE or CSPE encrypts sensitive information, like personally identifiable information (PII) or organizational identifiable information (OII), when data enters or leaves the Confluent Cloud. This means only authorized users can access the sensitive information. CSFLE or CSPE uses encryption/decryption key through access to an external Key Management Service (KMS). When data comes in from the external system, source connectors using CSFLE or CSPE encrypt the data before writing it to a Kafka topic. Then, sink connectors that have the correct encryption keys can decrypt the data to read the protected information or send to other target system. This way, both when data is being produced and consumed, CSFLE or CSPE protects sensitive data, allowing only authorized people access. This guide describes how developers can use CSFLE or CSPE in fully managed source and sink connectors. ## Limitations - The connector does not support auto schema registration. You must manually register the schema. - The connector does not support auto schema evolution. - The connector only supports encryption for schema-based input data formats such as Avro, JSON_SR, and Protobuf. - The connector only supports encryption for fields of type `string` or `bytes` for CSFLE. - The CSFLE does not work for `string` and `bytes` fields within nested JSON_SR formats when the `value.converter.decimal.format` is set to `BASE64`. To workaround this limitation, set `value.converter.decimal.format` to `NUMERIC`. - For source connector, CSFLE or CSPE fails to encrypt data if Confluent Cloud does not have access to Key Encryption Keys (KEKs) in your external KMS. For more information, see [Creating KEK in an external KMS](../security/encrypt/csfle/client-side.md#use-client-side-field-level-encryption). - For sink connector, CSFLE or CSPE may continue to share encrypted data to the target system if you choose to ignore (`NONE`) connector behavior on data decryption failures, specifically related to accessing the KEKs. By default, the connector behavior on data decryption failure is set to `ERROR` and the connector throws a DataException error and writes the encrypted data to the dead letter queue (DLQ). #### IMPORTANT When using CSFLE or CSPE with connectors that route failed messages to a Dead Letter Queue (DLQ), be aware that **data sent to the DLQ is written in plaintext (unencrypted)**. This poses a significant security risk as sensitive data that should be encrypted may be exposed in the DLQ. **Do not use DLQ with CSFLE or CSPE** in the current version. If you need error handling for CSFLE- or CSPE-enabled data, use alternative approaches such as: * Setting the connector behavior to `ERROR` to throw exceptions instead of routing to DLQ * Implementing custom error handling in your applications * Using `NONE` to pass encrypted data through without decryption - CSFLE- or CSPE-enabled connectors typically require about 5 minutes to apply the latest rules. For example, if you add a new PII tag to a new field, the active connector will start using this rule 5 minutes later. ## Supported connectors The following connectors support CSFLE and CSPE: ### Source connectors The following fully managed source connectors support CSFLE and CSPE: - [Amazon S3 Source connector](cc-s3-source.md#cc-s3-source-setup-connection) - [Azure Blob Storage Source connector](cc-azure-blob-source.md#cc-azure-blob-source-setup-connection) - [Azure Cosmos DB Source V2 connector](cc-azure-cosmos-source-v2.md#cc-cosmosdb-source-v2-setup-connection) - [Azure Service Bus Source connector](cc-azure-service-bus-source.md#cc-azure-service-bus-source-setup-connection) - [Google Cloud Spanner CDC Source (Debezium) connector](cc-google-spanner-cdc-source-debezium.md#cc-google-spanner-cdc-source-debezium-setup-connection) - [HTTP Source V2 connector](cc-http-source-v2.md#cc-http-source-v2-connection) - [IBM MQ Source connector](cc-ibmmq-source.md#cc-ibmmq-source-setup-connection) - [MariaDB CDC Source connector](cc-mariadb-cdc-source-debezium.md#cc-mariadb-cdc-source-debezium-setup-connection) - [Microsoft SQL Server CDC Source V2 (Debezium) connector](cc-microsoft-sql-server-source-cdc-v2-debezium/cc-microsoft-sql-server-source-cdc-v2-debezium.md#cc-microsoft-sql-server-cdc-source-v2-debezium-setup-connection) - [Microsoft SQL Server Source (JDBC) connector](cc-microsoft-sql-server-source.md#cc-microsoft-sql-server-source-setup-connection) - [MySQL CDC Source V2 (Debezium) connector](cc-mysql-source-cdc-v2-debezium/cc-mysql-source-cdc-v2-debezium.md#cc-mysql-cdc-source-v2-debezium-setup-connection) - [Oracle XStream CDC Source connector](cc-oracle-xstream-cdc-source/cc-oracle-xstream-cdc-source.md#cc-oracle-xstream-cdc-source-setup-connection) - [PostgreSQL CDC Source V2 (Debezium) connector](cc-postgresql-cdc-source-v2-debezium/cc-postgresql-cdc-source-v2-debezium.md#cc-postgresql-source-cdc-v2-debezium-setup-connection) - [Redis Kafka Source connector](cc-redis-kafka-source.md#cc-redis-kafka-source-setup-connection) - [Salesforce Bulk API 2.0 Source connector](cc-salesforce-bulk-api-v2-source.md#cc-salesforce-bulk-api-v2-source-setup-connection) - [Salesforce CDC Source connector](cc-salesforce-source-cdc.md#cc-salesforce-cdc-source-setup-connection) - [Salesforce Platform Event Source connector](cc-salesforce-platform-event-source.md#cc-salesforce-platform-event-source-setup-connection) - [Salesforce Source V2 connector](cc-salesforce-source-v2.md#cc-salesforce-source-v2-setup-connection) - [ServiceNow Source [Legacy] connector](cc-servicenow-source.md#cc-servicenow-source-setup-connection) - [ServiceNow Source V2 connector](cc-servicenow-source-v2.md#cc-servicenow-source-v2-connection) - [SFTP Source connector](cc-sftp-source.md#cc-sftp-source-setup-connection) - [Snowflake Source connector](cc-snowflake-source/cc-snowflake-source.md#cc-snowflake-source-setup-connection) ### Sink connectors The following fully managed sink connectors support CSFLE and CSPE: - [Amazon DocumentDB Sink connector](cc-amazon-document-db-sink/cc-document-db-sink.md#cc-document-db-sink-setup-connection) - [Amazon S3 Sink connector](cc-s3-sink/cc-s3-sink.md#cc-s3-sink-setup-connection) - [Azure Cosmos DB Sink V2 connector](cc-azure-cosmos-sink-v2.md#cc-azure-cosmos-v2-sink-setup-connection) - [Azure Data Lake Storage Gen2 Sink connector](cc-azure-datalakeGen2-storage-sink.md#cc-azure-datalakegen2-sink-setup-connection) - [ClickHouse Sink connector](cc-clickhouse-sink-connector/cc-clickhouse-sink.md#cc-clickhouse-sink) - [Couchbase Sink connector](cc-couchbase-db-sink/cc-couchbase-db-sink.md#cc-couchbase-sink-setup-connection) - [Google BigQuery Sink V2 connector](cc-gcp-bigquery-storage-sink.md#cc-gcp-bigquery-storage-sink-setup-connection) - [Google Cloud Firestore Sink connector](cc-gcp-firestore-sink.md#cc-gcp-firestore-sink-setup-connection) - [Google Cloud Functions Gen 2 Sink connector](cc-google-cloud-functions-gen2-sink.md#cc-google-cloud-functions-gen2-sink-connection) - [HTTP Sink V2 connector](cc-http-sink-v2.md#cc-http-sink-v2-connection) - [IBM MQ Sink connector](cc-ibm-mq-sink.md#cc-ibm-mq-sink) (CSFLE only) - [MongoDB Atlas Sink connector](cc-mongo-db-sink/cc-mongo-db-sink.md#cc-mongo-db-sink-setup-connection) - [Redis Kafka Sink connector](cc-redis-kafka-db-sink.md#cc-redis-kafka-sink-setup-connection) - [Salesforce Bulk API 2.0 Sink connector](cc-salesforce-bulk-api-v2-sink.md#cc-salesforce-bulk-api-v2-sink-setup-connection) - [Salesforce Platform Event Sink connector](cc-salesforce-platform-event-sink.md#cc-salesforce-platform-event-sink-setup-connection) - [Salesforce SObject Sink connector](cc-salesforce-SObjects-sink.md#cc-salesforce-sobjects-sink-connection) - [Snowflake Sink connector](cc-snowflake-sink/cc-snowflake-sink.md#cc-snowflake-sink-setup-connection) - [ServiceNow Sink connector](cc-servicenow-sink.md#cc-servicenow-sink-setup-connection) ## Manage client-side encryption The client-side encryption is available in Confluent Cloud to help you protect sensitive data in your Confluent Cloud account and perform stream processing on encrypted data. You must configure CSFLE or CSPE in Confluent Cloud before you modify an existing connector or create a new one with CSFLE or CSPE enabled. At a high level, you can manage client-side encryption for connectors using the following 2-step process: 1. [Configure CSFLE in Confluent Cloud](#configure-csfle-connector) or [Configure CSPE in Confluent Cloud](#configure-cspe-connector) 2. [Enable CSFLE or CSPE in connectors](#enable-csfle-connector) ### Configure CSFLE in Confluent Cloud Complete the following configuration steps: - Define the [schema for the topic](../sr/schemas-manage.md#cloud-schema-create) and add [tags](../sr/schemas-manage.md#cloud-schema-tagging) to the fields in the schema that you want to encrypt. - Create [encryption keys](../security/encrypt/csfle/manage-csfle.md#add-encryption-key-csfle) for each KMS and allow Confluent Cloud to access your KMS. - Add [encryption rules](../security/encrypt/csfle/manage-csfle.md#add-encryption-rule-csfle) that specify the encryption key you want to use to encrypt the tags. - Modify an existing [service account](service-account.md#s3-cloud-service-account) or create a new one with DeveloperWrite RBAC grant to schema and encryption keys in the schema registry. This ensures that the connector can read and create schemas and data encryption keys (DEKs) it may require for upstream and downstream operations. For more information about CSFLE configuration in Confluent Cloud, see [Manage Client-Side Field Level Encryption using Confluent Cloud Console](../security/encrypt/csfle/manage-csfle.md#manage-csfle-ccloud-console). ### Configure CSPE in Confluent Cloud Complete the following configuration steps: - Define the [schema for the topic](../sr/schemas-manage.md#cloud-schema-create) that you want to encrypt. - Create [encryption keys](../security/encrypt/csfle/manage-csfle.md#add-encryption-key-csfle) and allow Confluent Cloud to access your KMS. - Add payload [encryption encoding rules](../security/encrypt/csfle/manage-csfle.md#add-encryption-rule-csfle) that specify the encryption key you want to use to encrypt the tags. - Modify an existing [service account](service-account.md#s3-cloud-service-account) or create a new one with **DeveloperWrite** RBAC grant to schema and encryption keys in the schema registry. This ensures that the connector can read and create schemas and data encryption keys (DEKs) it may require for upstream and downstream operations. For more information about CSPE configuration in Confluent Cloud, see [Protect Sensitive Data Using Client-Side Payload Encryption on Confluent Cloud](../security/encrypt/cspe.md#use-client-side-payload-encryption). ### Enable CSFLE or CSPE in connectors Use Confluent Cloud console to modify connectors or create new ones with CSFLE or CSPE enabled, protecting your most sensitive data across producers and consumers, thereby securing all data in motion, including the most sensitive information. **Source connector considerations:** Confluent recommends creating new source connectors for CSFLE or CSPE with separate topics for encryption and non-encryption scenarios, rather than modifying existing connectors for CSFLE or CSPE. However, if you choose to enable CSFLE or CSPE on an existing source connector, you should follow the below step: 1. Pause the connector and ensure no other source connector writes to the same topic, to prevent schema conflicts and overrides. 2. Register the new schema, tags, encryption keys, and rules, ensuring the latest schema version adds these elements. For more information, see [Configure CSFLE in Confluent Cloud](#configure-csfle-connector) or [Configure CSPE in Confluent Cloud](#configure-cspe-connector). 3. Update the paused connector’s configuration to enable CSFLE or CSPE. 4. Resume the connector. To activate CSFLE or CSPE for supported connectors, see the quick start section of the [supported connectors](#supported-source-csfle). ### Source connector At the **Add Source Connector** screen, complete the following in the configuration step: 1. In **Data encryption** section, click **Enable Client-Side Field Level Encryption** to encrypt the data when writing to a topic. 2. Specify a **service account** to access the Schema Registry and associated encryption rules or keys with that schema. For more information about complete connector configuration, including CSFLE or CSPE setup, see the configuration step, for example, when creating a [S3 Source connector](cc-s3-source.md#cc-s3-source-setup-connection). ### Sink connector At the **Add Sink Connector** screen, complete the following in the configuration step: 1. In **Data decryption** section, click **Enable Client-Side Field Level Encryption** to decrypt the encrypted data before transferring into a target system. 2. Specify a **service account** to access the Schema Registry and associated encryption rules or keys with that schema. 3. Select the connector behavior on data decryption failure. Allowed values are `ERROR` and `NONE`. - If you select `NONE`, the connector writes the encrypted data in the target system without decryption. - If you select `ERROR`, the connector throws an error and writes the encrypted data in the DLQ system. For more information about complete connector configuration, including CSFLE or CSPE setup, see the configuration step, for example, when creating a [S3 Sink connector](cc-s3-sink/cc-s3-sink.md#cc-s3-sink-setup-connection). ## Related content - Learn about [CSFLE on Confluent Cloud](../security/encrypt/csfle/overview.md#client-side-field-level-encryption). - Learn about [CSPE on Confluent Cloud](../security/encrypt/cspe.md#use-client-side-payload-encryption).