# Configure RBAC for Connectors in Confluent Cloud Role-based access control (RBAC) uses roles and role mappings to provide different levels of access for a [principal](../_glossary.md#term-principal) to authenticate with Apache Kafka® and fully managed connectors. #### NOTE * RBAC for fully managed and custom connectors is available for Standard, Enterprise, Dedicated, and Freight Kafka [clusters](../clusters/cluster-types.md#cloud-cluster-types) only. * For self-managed connectors running in Confluent Platform, see [RBAC for Self-Managed Connectors](https://docs.confluent.io/platform/current/connect/rbac/connect-rbac-getting-started.html). ## RBAC role mappings #### NOTE As of **April 11, 2025**, the [Operator](../security/access-control/rbac/predefined-rbac-roles.md#operator-role) role no longer has permissions to pause and resume connectors. Confluent removed permissions to pause and resume connectors from the Operator role in Confluent Cloud, aligning with broad customer feedback. This change restores to administrators a read-only Operator role that can view metadata and monitor resources without the right to modify resources. You can grant users the [ConnectManager](../security/access-control/rbac/predefined-rbac-roles.md#connectmanager-role) role to monitor, pause, and resume connectors in your clusters. ### RBAC role mappings for fully managed connectors The table below shows the RBAC role mappings for fully managed connectors. | Role | Interact with Managed Connectors | Create a Data Preview Instance | View Data Preview Output | Read Configuration | Read Status | View Logs | Read Throughput Metrics | Pause, Resume, and Restart | Configure | Configure Kafka Credentials | Manage Access | Delete | |------------------------------------------------------------------------------------------------------|------------------------------------|----------------------------------|----------------------------|----------------------|---------------|-------------|---------------------------|------------------------------|-------------|-------------------------------|-----------------|----------| | [OrganizationAdmin](../security/access-control/rbac/predefined-rbac-roles.md#organizationadmin-role) | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | | [EnvironmentAdmin](../security/access-control/rbac/predefined-rbac-roles.md#environmentadmin-role) | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | | [CloudClusterAdmin](../security/access-control/rbac/predefined-rbac-roles.md#cloudclusteradmin-role) | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | | [Operator](../security/access-control/rbac/predefined-rbac-roles.md#operator-role) | No | No | [1] | No | Yes | No | Yes | Yes | No | No | No | No | | [ResourceOwner](../security/access-control/rbac/predefined-rbac-roles.md#resourceowner-role) | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | | [ConnectManager](../security/access-control/rbac/predefined-rbac-roles.md#connectmanager-role) | No | No | [1] | Yes | Yes | Yes | Yes | Yes | No | No | No | No | | [DeveloperWrite](../security/access-control/rbac/predefined-rbac-roles.md#developerwrite-role) | No | No | [1] | Yes | Yes | No | Yes | No | Yes | No | No | No | | [DeveloperRead](../security/access-control/rbac/predefined-rbac-roles.md#developerread-role) | No | No | [1] | Yes | Yes | No | Yes | No | No | No | No | No | [1] The role can view the data preview output only if the role has `READ` access to the data preview topic. #### NOTE The **Configure Kafka Credentials** column also determines whether the `kafka.service.account.id` value is returned unmasked when you call the [List connector extensions](https://docs.confluent.io/cloud/current/api.html#tag/Connectors-(connectv1)/operation/listConnectv1ConnectorsWithExpansions) or [Read connector configurations](https://docs.confluent.io/cloud/current/api.html#tag/Connectors-(connectv1)/operation/getConnectv1ConnectorConfig) Confluent Cloud REST API endpoints. Only roles with a **Yes** in this column receive the Kafka service account ID unmasked in the API response; all other roles receive a masked value. Certain Confluent Cloud RBAC roles are currently unavailable for fully managed custom connectors. For the full list of RBAC roles and role mappings used for Confluent Cloud, see [Predefined RBAC Roles in Confluent Cloud](../security/access-control/rbac/predefined-rbac-roles.md#cloud-rbac-roles). For additional information, see [Role-based Access Control (RBAC) on Confluent Cloud](../security/access-control/rbac/overview.md#cloud-rbac). ### RBAC role mappings for custom connectors The table below shows the RBAC role mappings for custom connectors. | Users/Service Account | Scope | Assign Access to users on Custom Connectors (Not Artifacts) | Upload Artifact | Edit/Update Artifact | List/Describe Artifacts | Delete Artifacts | Create Custom Connector | Edit Custom Connectors | List/Describe Custom Connectors | Delete Custom Connectors | Read Custom Connector Status | Read Custom Connector Metrics | Pause/Resume/Restart Custom Connectors | View Custom Connector Logs | |------------------------------------------------------------------------------------------------------------|----------------------------------|---------------------------------------------------------------|-------------------|------------------------|---------------------------|--------------------|---------------------------|--------------------------|-----------------------------------|----------------------------|--------------------------------|---------------------------------|------------------------------------------|------------------------------| | [OrganizationAdmin](../security/access-control/rbac/predefined-rbac-roles.md#organizationadmin-role) | Organization | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | | [EnvironmentAdmin](../security/access-control/rbac/predefined-rbac-roles.md#environmentadmin-role) | Environment | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | | [CloudClusterAdmin](../security/access-control/rbac/predefined-rbac-roles.md#cloudclusteradmin-role) “[1]” | Cluster | Yes | No | No | Yes | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | | [Operator](../security/access-control/rbac/predefined-rbac-roles.md#operator-role) | Organization/Environment/Cluster | No | No | No | No | No | No | No | Yes | No | Yes | Yes | No | No | | [DeveloperRead](../security/access-control/rbac/predefined-rbac-roles.md#developerread-role) | Connector(s) | No | No | No | No | No | No | No | Yes | No | Yes | Yes | No | No | | [DeveloperWrite](../security/access-control/rbac/predefined-rbac-roles.md#developerwrite-role) | Connector(s) | No | No | No | No | No | No | Yes | Yes | No | Yes | Yes | Yes | No | | [ConnectManager](../security/access-control/rbac/predefined-rbac-roles.md#connectmanager-role) | Connector(s) | No | No | No | No | No | No | No | Yes | No | Yes | Yes | Yes | Yes | | [ResourceOwner](../security/access-control/rbac/predefined-rbac-roles.md#resourceowner-role) | Connector(s) | Yes | No | No | Yes | No | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes | [1] [CloudClusterAdmin](../security/access-control/rbac/predefined-rbac-roles.md#cloudclusteradmin-role) role has different permissions based on the resource (Connect API vs CCPM API). The role mapping in this table is valid for CCPM APIs as it does not allow Cluster Admins to create, edit or delete plugins. ## Manage role assignments using the Cloud Console Complete the following steps to configure a role assignment for a user or service principal. You must have administrative permissions to work with role assignments. 1. Open the **Administration menu**. 2. Select **Accounts & access**. 3. Select **Access**. 4. Select the cluster where you want to configure connector permissions, then click **Connectors**. You may see one or more assigned roles. ![Connector permissions](images/ccloud-connect-rbac-access-cluster-connectors.png) The following message may be displayed if you have no connector role assignments in the cluster. ![No Role Assignments](images/ccloud-connect-rbac-no-role-assignments-message.png) ### Add a new role assignment Complete the following steps to add a role assignment. 1. Click the **Add role assignment** button. 2. Select an existing connector name. You can enter a new connector name here. This allows you to create the role assignment prior to creating the connector. 3. Select the account where you want to apply the role assignment. 4. Select **DeveloperRead** or **DeveloperWrite**. For specific permissions and other details, see [RBAC role mappings](#managed-connector-rbac-role-mappings). 5. Click **Save**. ### Delete a role assignment To delete a role assignment, click a listed account name and then click the trash can icon. Only administrative roles can delete a role assignment. ![Delete Role Assignment](images/ccloud-connect-rbac-delete-role-assignment.png) ## Manage role assignments using the Confluent CLI The following are typical commands to use when managing role assignments for fully managed connectors. To see the available command options: ```bash confluent iam rbac role-binding help ``` To list the role assignments: ```bash confluent iam rbac role-binding list --current-user ``` ```bash confluent iam rbac role-binding list --principal User:u-12ab34 ``` To create a role assignment: ```bash confluent iam rbac role-binding create --principal User:u-12ab34 \ --role DeveloperWrite --resource DatagenSourceConnector_0 \ --environment env-a12b34 --kafka-cluster-id lkc-123456 ``` To delete a role assignment: ```bash confluent iam rbac role-binding delete --principal User:u-12ab34 ``` For additional Confluent CLI command examples, see [List the role bindings for a principal](../security/access-control/rbac/manage-role-bindings.md#cloud-rbac-cli).