Confluent Cloud Provider Integration API for Managed Connectors¶
The Provider Integration API is a part of the Confluent Cloud APIs and focuses on managing the provider integration configurations. Using the REST API, you can map AWS Identity and Access Management (IAM) roles in Confluent through the provider integration setup.
Prerequisites¶
Be sure to have the following prerequisites completed before running any of the provider integration examples.
- Authorized access to Confluent Cloud.
- cURL and jq installed to use the API request examples in this document.
- The OrganizationAdmin or EnvironmentAdmin role to setup provider integration. If you do not have the appropriate role, reach out to your OrganizationAdmin or EnvironmentAdmin.
- A Confluent Cloud API key to authenticate with the Confluent Provider Integration API. For information about how to create a Confluent Cloud API key, see Manage API Keys.
- An environment ID, the identifier of the environment where your provider integration runs, for example, “env-00000”.
- AWS prerequisites
- An AWS IAM policy with permission policy created in your AWS account to provide access to the resource.
- An AWS IAM role and a custom trust policy created in your AWS account.
- AWS-specific configuration,
customer_iam_role_arn
detail.
Manage provider integration¶
Using requests to the Provider Integration REST API, you can perform the following actions:
- List provider integrations
- Register a provider integration
- Read a provider integration
- Delete a provider integration
Before you run any cURL requests, be sure to complete the prerequisites.
List provider integrations¶
To return a list of all provider integrations in an environment, use the following API request. Successful completion returns a list of fully-managed provider integrations.
- Request query parameters
environment
(mandatory): Retrieve the provider details by an environment ID.provider
(optional): Fetch the results for a particular provider. For example, provider=AWS.page_token
(optional): Retrieve a page based on a previously received tokenpage_size
(optional): Maximum number of items to return in a page. Note that the default page_size value is 10 and the maximum allowed is 100.
curl --request GET 'https://api.confluent.cloud/pim/v1/integrations?provider=AWS&environment=env-00000' \
--header 'authorization: Basic <base64-encoded-key-and-secret>' | jq
The output displays a list of provider integrations. For example:
Response from a request to list provider integrations
{
"api_version": "pim/v1",
"kind": "IntegrationList",
"metadata": {
"first": "https://api.confluent.cloud/pim/v1/integrations",
"last": "https://api.confluent.cloud/pim/v1/integrations?page_token=bcAOehAY8F16YD84Z1wT",
"prev": "https://api.confluent.cloud/pim/v1/integrations?page_token=YIXRY97wWYmwzrax4dld",
"next": "https://api.confluent.cloud/pim/v1/integrations?page_token=UvmDWOB1iwfAIBPj6EYb",
"total_size": 123
},
"data": [
{
"api_version": "pim/v1",
"kind": "Integration",
"id": "dlz-f3a90de",
"display_name": "s3_provider_integration",
"provider": "AWS",
"config": {
"iam_role_arn": "arn:aws:iam::000000000000:role/confluent-aws-role",
"external_id": "95c35493-41aa-44f8-9154-5a25cbbc1865",
"customer_iam_role_arn": "arn:aws:iam::000000000000:role/my-test-aws-role",
"kind": "AwsIntegrationConfig"
},
"usages": [
"crn://confluent.cloud/organization=9bb441c4-edef-46ac-8a41-c49e44a3fd9a/environment=env-456xy/cloud-cluster=lkc-123abc/connector=my_datagen_connector"
],
"environment": {
"id": "env-00000",
"related": "https://api.confluent.cloud/v2/environments/env-00000",
"resource_name": "https://api.confluent.cloud/organization=9bb441c4-edef-46ac-8a41-c49e44a3fd9a/environment=env-00000"
}
}
]
}
Register a provider integration¶
Create a provider integration in your environment by including the following cloud provider-specific configuration details in the API request.
- Body parameters
display_name
(mandatory): Display name of the provider integration.provider
(mandatory): Name of the cloud service provider to which access is provided through provider integration.customer_iam_role_arn
(mandatory): This configuration specifies the Amazon Resource Name (ARN) of the IAM role in your AWS account that Confluent Cloud will assume to access resources in your account.kind
(mandatory): This configuration is specified based on the provider for which the integration is created. For example,AwsIntegrationConfig
for AWS integration.environment id
(mandatory): The identifier of the environment where provider integration runs.
Creating a provider integration requires the following inputs:
curl --request POST \
--url https://api.confluent.cloud/pim/v1/integrations \
--header 'Authorization: Basic <base64-encoded-key-and-secret>' \
--header 'content-type: application/json' \
--data '{
"display_name":"s3_provider_integration",
"provider":"AWS",
"config":{
"customer_iam_role_arn":"arn:aws:iam::000000000000:role/my-test-aws-role",
"kind":"AwsIntegrationConfig"
},
"environment":{
"id":"env-00000"
}
}'| jq
The output displays the provider integration configuration. The external_id
configuration
in the output specifies a unique external ID used by Confluent Cloud to address and prevent
The confused deputy problem when
assuming the IAM role in your AWS account. The iam_role_arn
specifies the ARN
for the AWS IAM role that Confluent Cloud uses to assume the customer
IAM role when accessing resources in your aws account. Hence, this role should be added to the
IAM role trust policy in your AWS account. For example:
Response from a request to register a provider integration
{
"api_version": "pim/v1",
"kind": "Integration",
"id": "dlz-f3a90de",
"display_name": "s3_provider_integration",
"provider": "AWS",
"config": {
"iam_role_arn": "arn:aws:iam::000000000000:role/confluent-aws-role",
"external_id": "95c35493-41aa-44f8-9154-5a25cbbc1865",
"customer_iam_role_arn": "arn:aws:iam::000000000000:role/my-test-aws-role",
"kind": "AwsIntegrationConfig"
},
"usages": [
"crn://confluent.cloud/organization=9bb441c4-edef-46ac-8a41-c49e44a3fd9a/environment=env-456xy/cloud-cluster=lkc-123abc/connector=my_datagen_connector"
],
"environment": {
"id": "env-00000",
"related": "https://api.confluent.cloud/v2/environments/env-00000",
"resource_name": "https://api.confluent.cloud/organization=9bb441c4-edef-46ac-8a41-c49e44a3fd9a/environment=env-00000"
}
}
Read a provider integration¶
Use the following API request to read a provider integration configuration in your environment. Successful completion returns an integration configuration.
curl --request GET \
--url 'https://api.confluent.cloud/pim/v1/integrations/{id}?environment={environment-id}' \
--header 'Authorization: Basic <base64-encoded-key-and-secret' | jq
Specify id
, a unique identifier for the integration and environment
in the GET request. For example:
curl --request GET \
--url 'https://api.confluent.cloud/pim/v1/integrations/dlz-f3a90de?environment=env-00000' \
--header 'authorization: Basic HIJKLMNOPYRlB9TNjVWUVXQmtQN1lkckFBYW1m5b2NDTWpPL29TS3pnMFVNb1hBMHgzQ1hqVmdsUEpIWUMv' | jq
The output displays the provider integration configuration. For example:
{
"api_version": "pim/v1",
"kind": "Integration",
"id": "dlz-f3a90de",
"display_name": "s3_provider_integration",
"provider": "AWS",
"config": {
"iam_role_arn": "arn:aws:iam::000000000000:role/confluent-aws-role",
"external_id": "95c35493-41aa-44f8-9154-5a25cbbc1865",
"customer_iam_role_arn": "arn:aws:iam::000000000000:role/my-test-aws-role",
"kind": "AwsIntegrationConfig"
},
"usages": [
"crn://confluent.cloud/organization=9bb441c4-edef-46ac-8a41-c49e44a3fd9a/environment=env-456xy/cloud-cluster=lkc-123abc/connector=my_datagen_connector"
],
"environment": {
"id": "env-00000",
"related": "https://api.confluent.cloud/v2/environments/env-00000",
"resource_name": "https://api.confluent.cloud/organization=9bb441c4-edef-46ac-8a41-c49e44a3fd9a/environment=env-00000"
}
}
Delete a provider integration¶
Use the following API request to delete a provider integration in your environment. Successful completion delete an integration configuration.
Note
The DELETE request will fail if any Confluent workloads are using this provider integration. Check HTTP status codes for more detail.
curl --request DELETE \
--url 'https://api.confluent.cloud/pim/v1/integrations/{id}?environment={environment-id}' \
--header 'Authorization: Basic <base64-encoded-key-and-secret' | jq
Specify id
, a unique identifier for the integration and environment
in the DELETE request. For example:
curl --request DELETE \
--url 'https://api.confluent.cloud/pim/v1/integrations/dlz-f3a90de?environment=env-00000' \
--header 'authorization: Basic HIJKLMNOPYRlB9TNjVWUVXQmtQN1lkckFBYW1m5b2NDTWpPL29TS3pnMFVNb1hBMHgzQ1hqVmdsUEpIWUMv' | jq