# Create a secret manager integration in Confluent Cloud Secret manager integration lets fully managed connectors in Confluent Cloud retrieve authentication credentials from AWS Secrets Manager, Azure Key Vault, or Google Cloud Secret Manager at runtime, so sensitive values such as database passwords and API keys never persist in Confluent Cloud. ## Overview Fully managed connectors in Confluent Cloud can integrate with secret managers from cloud service providers (CSPs) such as Azure Key Vault, AWS Secrets Manager, or Google Cloud Secret Manager to retrieve sensitive information such as database credentials, access keys, and similar authentication-related secrets. Secret manager integration ensures that your secrets never persist within the Confluent boundary, and Confluent Cloud always fetches them at runtime as needed. Secret manager integration uses Confluent Provider Integration to authenticate with your CSP and securely access secrets stored in services like Azure Key Vault, AWS Secrets Manager, or Google Cloud Secret Manager. For more information about provider integration in Confluent Cloud, see [Manage Provider Integration for Fully Managed Connectors in Confluent Cloud](../provider-integration.md#cloud-pi-quickstart). Confluent Cloud supports: - [Microsoft Azure Key Vault integration](azure-key-vault-integration.md#connector-azure-key-vault-integration) - [Amazon Web Services Secrets Manager integration](aws-secrets-manager-integration.md#connector-aws-secrets-manager-integration) - [Google Cloud Secret Manager integration](gcp-secret-manager-integration.md#connector-gc-secret-manager-integration) ## Key terms - **Secret manager**: A secret manager is a centralized system or service designed to securely store, manage, and retrieve sensitive data, often called `secrets`. - **Secret manager integration**: A Confluent Cloud feature that lets Confluent Cloud access secrets stored in a secret manager like AWS Secrets Manager, Azure Key Vault, or Google Cloud Secret Manager. - **Provider integration**: A Confluent Cloud feature that builds a trusted handshake between your AWS identity, Azure principal, or Google Cloud service account and your Confluent identity. - With Azure, it is the service principal through workload identity federation that lets Confluent Cloud call Azure APIs. - With AWS, it is an IAM role that Confluent Cloud assumes to call AWS APIs. - With Google Cloud, it is a service account that Confluent Cloud impersonates through workload identity federation to call Google Cloud APIs. - **Secret identifier**: The string that you enter into a connector configuration field so that Confluent Cloud can resolve the actual credential value at runtime from the secret manager. ## Supported connectors The following connectors support secret manager integration: ### Source connectors - [Amazon DynamoDB CDC Source Connector for Confluent Cloud](../cc-amazon-dynamodb-cdc-source/cc-amazon-dynamodb-cdc-source.md#cc-amazon-dynamodb-cdc-source) - [Azure Service Bus Source Connector for Confluent Cloud](../cc-azure-service-bus-source.md#cc-azure-service-bus-source) - [HTTP Source V2 Connector for Confluent Cloud](../cc-http-source-v2.md#cc-http-source-v2) - [Microsoft SQL Server CDC Source V2 (Debezium) Connector for Confluent Cloud](../cc-microsoft-sql-server-source-cdc-v2-debezium/cc-microsoft-sql-server-source-cdc-v2-debezium.md#cc-microsoft-sql-server-source-cdc-v2-debezium-configure-connector) - [Microsoft SQL Server Source (JDBC) Connector for Confluent Cloud](../cc-microsoft-sql-server-source.md#cc-microsoft-sql-server-source) - [MongoDB Atlas Source Connector for Confluent Cloud](../cc-mongo-db-source.md#cc-mongo-db-source) - [MongoDB CDC Source (Debezium) Connector for Confluent Cloud](../cc-mongodb-cdc-source/cc-mongodb-cdc-source-debezium.md#cc-mongodb-source-cdc-debezium-configure-connector) - [MySQL CDC Source V2 (Debezium) Connector for Confluent Cloud](../cc-mysql-source-cdc-v2-debezium/cc-mysql-source-cdc-v2-debezium.md#cc-mysql-source-cdc-v2-debezium-configure-connector) - [MySQL Source (JDBC) Connector for Confluent Cloud](../cc-mysql-source.md#cc-mysql-source) - [Oracle Database Source (JDBC) Connector for Confluent Cloud](../cc-oracle-db-source.md#cc-oracle-db-source) - [Overview and Features of Oracle XStream CDC Source Connector for Confluent Cloud](../cc-oracle-xstream-cdc-source/cc-oracle-xstream-cdc-source-features.md#cc-oracle-xstream-cdc-source) - [PostgreSQL CDC Source V2 (Debezium) Connector for Confluent Cloud](../cc-postgresql-cdc-source-v2-debezium/cc-postgresql-cdc-source-v2-debezium.md#cc-postgresql-cdc-source-v2-debezium-configure-connector) - [PostgreSQL Source (JDBC) Connector for Confluent Cloud](../cc-postgresql-source.md#cc-postgresql-source) - [Redis Kafka Source Connector for Confluent Cloud](../cc-redis-kafka-source.md#cc-redis-kafka-source) - [SFTP Source Connector for Confluent Cloud](../cc-sftp-source.md#cc-sftp-source) ### Sink connectors - [Amazon DynamoDB Sink Connector for Confluent Cloud](../cc-amazon-dynamo-db-sink.md#cc-amazon-dynamodb-sink) - [Amazon S3 Sink Connector for Confluent Cloud](../cc-s3-sink/cc-s3-sink.md#cc-s3-connect-sink) - [AWS Lambda Sink Connector for Confluent Cloud](../cc-aws-lambda-sink.md#cc-aws-lambda-sink) - [Azure Blob Storage Sink Connector for Confluent Cloud](../cc-azure-blob-sink/cc-azure-blob-sink.md#cc-azure-blob-sink) - [Azure Data Lake Storage Gen2 Sink Connector for Confluent Cloud](../cc-azure-datalakeGen2-storage-sink.md#cc-azure-datalakegen2storage-sink) - [Google BigQuery Sink V2 Connector for Confluent Cloud](../cc-gcp-bigquery-storage-sink.md#cc-gcp-bigquery-storage-api-sink) - [HTTP Sink V2 Connector for Confluent Cloud](../cc-http-sink-v2.md#cc-http-sink-v2) - [Microsoft SQL Server Sink (JDBC) Connector for Confluent Cloud](../cc-microsoft-sql-server-sink.md#cc-microsoft-sql-server-sink) - [MongoDB Atlas Sink Connector for Confluent Cloud](../cc-mongo-db-sink/cc-mongo-db-sink.md#cc-mongo-db-sink) - [MySQL Sink (JDBC) Connector for Confluent Cloud](../cc-mysql-sink.md#cc-mysql-sink) - [Oracle Database Sink (JDBC) Connector for Confluent Cloud](../cc-oracle-db-sink.md#cc-oracle-db-sink) - [PostgreSQL Sink (JDBC) Connector for Confluent Cloud](../cc-postgresql-sink.md#cc-postgresql-sink) - [Redis Kafka Sink Connector for Confluent Cloud](../cc-redis-kafka-db-sink.md#cc-redis-kafka-sink) - [Snowflake Sink Connector for Confluent Cloud](../cc-snowflake-sink/cc-snowflake-sink.md#cc-snowflake-sink) ## Limitations - **Cross-cloud limitations**: The secret manager must be in the same cloud provider as your Confluent Cloud cluster. For example, using Azure Key Vault with a Connect cluster on AWS is not supported. - **Supported cluster type**: Currently, you can integrate a secret manager only with Dedicated clusters. Limitations on integrating a CSP with Confluent Cloud are applicable to secret manager integration as well. For more information, see [Provider integration limitations](../provider-integration.md#ccloud-pi-limit). ## Secret rotation and lifecycle Secret manager integration retrieves secrets when: - A connector starts or restarts. - A connector enters into a failed state and it tries to recover. While it tries recovery, Confluent Cloud invalidates cached credentials and the connector tries to fetch the latest secrets from the secret manager. To apply rotated credentials from your secret manager immediately: 1. Rotate the secret in your secret manager using your CSP’s secret management tools. 2. Restart the connector in Confluent Cloud to fetch the updated secret using one of these methods: - On the Confluent Cloud Console, navigate to the connector settings and click **Restart**. - Use the [Restart a Connector](https://docs.confluent.io/cloud/current/ccloud/restart-connectv-1-connector/) Confluent REST API. ## Related content - [Manage Provider Integration for Fully Managed Connectors](../provider-integration.md#cloud-pi-quickstart) - [Microsoft Azure Key Vault integration](azure-key-vault-integration.md#connector-azure-key-vault-integration) - [Amazon Web Services Secrets Manager integration](aws-secrets-manager-integration.md#connector-aws-secrets-manager-integration) - [Google Cloud Secret Manager integration](gcp-secret-manager-integration.md#connector-gc-secret-manager-integration) - [Provider Integration CLI](https://docs.confluent.io/confluent-cli/current/command-reference/provider-integration/index.html)