# FAQ for Confluent Cloud Find answers to frequently asked questions about [Confluent Cloud](https://www.confluent.io/confluent-cloud/), a fully managed, cloud-native data streaming platform. This page provides information on security, support plans, and more. ## How do I sign up for free trial of Confluent Cloud? Sign up at [https://confluent.cloud](https://confluent.cloud). For details on the temporary free trial that Confluent Cloud offers, see [Confluent Cloud Free Trial](get-started/free-trial.md#free-trial). ## What version of Kafka do Confluent Cloud brokers and clients use? Confluent Cloud is built upon Kora, Confluent’s proprietary cloud-native Apache Kafka® engine which supports full and strict protocol compatibility with Kafka. Kora brokers are updated regularly with the latest features and security patches from Kafka, but do not strictly track any open-source release. Client compatibility is covered in depth in [Client versions and support](client-apps/overview.md#client-support-matrix). Confluent Platform does not share the same release cycle as Confluent Cloud. For more details of Confluent Platform compatibility, see [Confluent Platform support versions](/platform/current/installation/versions-interoperability.html). ## What client and protocol versions are supported? - Confluent Cloud follows the Confluent Platform [client version support policy](/platform/current/installation/versions-interoperability.html#cp-ak-compatibility). - To connect to Confluent Cloud, compatible clients must support and implement TLS encryption and SASL_PLAIN or SASL_OAUTHBEARER (with OAuth-OIDC configured) authentication. - All client features since 0.10.0.0 are supported, including exactly-once delivery semantics. ## What security, compliance, and privacy features does Confluent Cloud provide? Confluent’s product offerings are designed to support the needs of enterprise customers for security, compliance, and privacy. For information on compliance and security, see the [Trust & Security page](https://www.confluent.io/trust-and-security/) page. See [What specific security features does Confluent Cloud offer?](#security-features) for more details about security features. ## What specific security features does Confluent Cloud offer? - All traffic over the wire requires TLS 1.2 encryption and authentication for SASL_PLAIN or SASL_OAUTHBEARER (with OAuth-OIDC identity provider configured). - All data is encrypted at rest on encrypted volumes. Confluent Cloud ensures encryption on customer data stored at rest through the native encryption services offered by our cloud providers. - [BYOK encryption](security/encrypt/byok/overview.md#byok-encrypted-clusters) is supported for data at rest for Dedicated clusters on AWS, Azure, and Google Cloud. - You control the API keys and secrets specific to your cluster which you can revoke or reissue if necessary. - All data is stored on secure infrastructure, with access controls that are restricted to Confluent engineers, inside a Confluent controlled VPC. - Confluent Cloud Dedicated clusters provide dedicated compute and storage resources. - [VPC Peering (optional)](networking/overview.md#cloud-networking) provides network-level security for customers with Dedicated Clusters in Confluent Cloud. - [Single sign-on (SSO)](security/authenticate/user-identities/user-idps/sso/overview.md#sso-saml) using your existing SAML-based identity provider (IdP). Confluent Cloud SSO provides access control for multiple independent software systems. For more information, see the [Confluent Cloud Security Addendum](https://www.confluent.io/cloud-enterprise-security-addendum) and the [Confluent Cloud Security Controls](https://assets.confluent.io/m/67f93edfe1a9f524/original/20200805-WP-Confluent_Cloud_Security_Controls.pdf) whitepaper. ## What version of TLS is supported on Confluent Cloud? TLS version 1.2 is supported. #### IMPORTANT Effective March 15, 2020, connections made by using TLS 1.0 and 1.1 are no longer supported. TLS 1.0 and 1.1 are legacy cryptographic protocols that do not support modern cryptographic algorithms. They contain security vulnerabilities that can be exploited by attackers. The Internet Engineering Task Force is planning to officially [deprecate both protocols](https://tools.ietf.org/html/draft-ietf-tls-oldversions-deprecate-00). The majority of encrypted internet traffic is now over TLS 1.2. TLS 1.2 has been the recommended version for IETF protocols since 2008. ## Is Kerberos supported on Confluent Cloud? Kerberos authentication is not supported. ## Can I set up mTLS in Confluent Cloud? Yes, mutual TLS (mTLS) authentication authentication is supported on Dedicated clusters on any cloud provider, and on AWS Enterprise and Freight clusters. You provide your own Certificate Authority (CA), and Confluent Cloud brokers validate client certificates against it. For requirements and setup steps, see [Configure mutual TLS (mTLS) authentication on Confluent Cloud](security/authenticate/workload-identities/identity-providers/mtls/configure.md#configure-mtls). ## Are Confluent Cloud IP addresses and hostnames static? In most cases, no. For details, see [IP addresses for public endpoints](networking/overview.md#cloud-ip-addresses-not-static). The following blogs describe how the common outbound proxies handle IP address changes: * [DNS for Service Discovery in HAProxy - HAProxy Technologies](https://www.haproxy.com/blog/dns-service-discovery-haproxy/). * [DNS for Service Discovery with NGINX and NGINX Plus](https://www.nginx.com/blog/dns-service-discovery-nginx-plus/). ## How do I connect Confluent Platform components to Confluent Cloud? Connection instructions vary by by Confluent Platform component. See [Connect Confluent Platform Components to Confluent Cloud](cp-component/index.md#cloud-connect) for a list of topics. ## How do I grant other users access to my cluster? Confluent provides a variety of ways to manage access to your data. See [User account types](security/authenticate/user-identities/user-accounts/overview.md#user-accounts) for more information. ## Can I use the same user account for multiple Confluent Cloud organizations? Yes. For details, see [Manage Multiple Organizations on Confluent Cloud](security/access-control/hierarchy/organizations/multiple-organizations.md#multiple-organizations). ## Can I be auto-notified about failures or incidents? Yes, you can view and subscribe to the [Confluent Cloud status page](https://status.confluent.cloud/). ## Can I get help troubleshooting failures on my own before I contact support? Yes, use this [support article](https://support.confluent.io/hc/en-us/articles/7781369837204-What-to-check-if-Confluent-Cloud-is-unreachable) to troubleshoot connectivity issues with Confluent Cloud. ## Can I access logs for Confluent Cloud services? Internal service logs for Confluent Cloud managed services (such as Kafka brokers, Schema Registry, and other infrastructure components) are not directly accessible to customers, but there are several tools and approaches to help you debug and monitor your streaming applications. **General monitoring and debugging tools:** The [Confluent Cloud Metrics](monitoring/metrics-api.md#metrics-api) provides actionable operational metrics about your Confluent Cloud deployment. The Confluent Cloud Console shows cluster activity and usage relative to your cluster’s capacity. The Cloud Console also includes [topic management](topics/overview.md#cloud-topics-manage) and [consumer lag monitoring](monitoring/monitor-lag.md#cloud-monitoring-lag). [Build Streaming Applications](client-apps/index.md#ccloud-best-practices) details best practices for configuring, monitoring, and debugging Kafka clients. **Component-specific logging options:** For some Confluent Cloud services, specific logging and monitoring capabilities are available: - **Audit logs**: [Confluent Cloud audit logs](monitoring/audit-logging/cloud-audit-log-concepts.md#cloud-audit-logs) track administrative and data plane activities within your organization. - **Connector events**: [View connector events](connectors/logging-cloud-connectors.md#ccloud-connector-logging) to monitor and troubleshoot your connectors. - **Flink user-defined functions**: [Enable logging in Flink UDFs](flink/how-to-guides/enable-udf-logging.md#flink-sql-enable-udf-logging) for custom application debugging. - **ksqlDB processing logs**: Monitor ksqlDB application health using [ksqlDB processing logs](ksqldb/monitoring-ksqldb.md#cloud-ksql-monitor). For comprehensive monitoring guidance, see [Confluent Cloud Metrics](monitoring/metrics-api.md#metrics-api). ## Can I chat live in Cloud Console? Yes, to chat with a live sales representative from the AI Assistant, you must have pop-ups enabled in your browser. ## Can deleted Confluent Cloud components be restored? No. When you delete components from your Confluent Cloud account, they are permanently deleted and cannot be restored. ## How do I change support plans? You can manage your support plan by clicking the help icon in the upper-right corner of the Confluent Cloud window. From the menu that appears, click **Support Plans**.  The **Support Plans** page shows which plan you have currently. You can also choose a different plan from this page by clicking **Select** in the description of the plan. The next window that opens shows the pricing details for that plan and asks you to confirm your support plan upgrade. Click **Confirm upgrade** to upgrade, or click **Close** to cancel. See [Confluent Support for Confluent Cloud](support.md#support-plans-overview) for more information. #### IMPORTANT Downgrade restrictions apply to support plan purchases. Your current support level will stay in effect until the end of the current calendar month. However, if you downgrade within the month of purchase, your current support plan level is maintained until the end of the **next full** calendar month. ## What are the recommended JVM settings for Java clients? There are two recommended JVM settings for Java clients: JVM Security configuration : ```none java.security.Security.setProperty(“networkaddress.cache.ttl” , “30"); java.security.Security.setProperty(“networkaddress.cache.negative.ttl” , “0"); ``` Kafka Producer and Consumer configuration : ```none consumer.client.dns.lookup="use_all_dns_ips" producer.client.dns.lookup="use_all_dns_ips" ``` For more on configuring Java clients, see [Configure clients](client-apps/config-client.md#ccloud-clients). ## How do I access the Cloud Console? Access the Cloud Console at the following URL: [https://confluent.cloud](https://confluent.cloud) To access the console, you will be required to sign in to your Confluent Cloud account. You can sign up for a [free account](get-started/free-trial.md#free-trial), if you don’t have an account. ## What web browsers does Cloud Console support? The latest stable versions of the following web browsers are supported by Confluent Cloud Console: - [Apple Safari](https://www.apple.com/safari/) - [Google Chrome](https://www.google.com/chrome/) - [Mozilla Firefox](https://www.mozilla.org/en-US/firefox/new/) ## What user session timeouts does Cloud Console require? Each time you access your Confluent Cloud account in the Cloud Console from a web browser, you must sign in. These session length limits apply to your account: - Idle timeout: If you do not interact with the Cloud Console by mouse, keyboard, or window activity for two hours, you are logged out. An open browser tab is not considered activity. - Maximum timeout: If you are logged in to Confluent Cloud for eight hours, you are logged out and must sign in again, regardless of activity. The Cloud Console displays warning banners before a session ends: - An idle session warning appears 15 minutes before the idle timeout is reached. Any interaction with the console dismisses the warning and extends the session. - A maximum session warning appears 60 minutes before the eight-hour maximum session length is reached. This warning can’t be dismissed. These timeouts apply only to browser-based access to the Cloud Console. Access from the Confluent CLI, the Confluent Cloud REST APIs, and client applications is not affected. The two-hour idle timeout is the default. If your organization requires a shorter idle timeout, you can request a one-hour idle timeout by contacting [Confluent Support](https://support.confluent.io/) with your organization ID. The eight-hour maximum session length cannot be configured or changed. ## What domains does the Cloud Console require? The Cloud Console requires access to the following domains to function properly: - `https://confluent.cloud` - `https://login.confluent.io` - `https://api.confluent.cloud` - Access to static assets, such as fonts and images: - `https://cloud-static.confluent.io` - `https://fonts.googleapis.com` - `https://fonts.gstatic.com` - Access to Stripe (payment info): - `https://js.stripe.com` - `https://m.stripe.network` - `https://m.stripe.com` - `https://q.stripe.com` - Access to the Confluent Metrics API: - `https://api.telemetry.confluent.cloud` - Access to Confluent Cloud for Apache Flink: - `https://flink...confluent.cloud` The following domains are not required for the Cloud Console to operate properly, but are recommended: - Sentry, for debugging purposes: - `https://o114100.ingest.sentry.io` - For access to on-page help: - `https://cdn.contentful.com` ## How do I access Confluent CLI and support from Cloud Console? See instructions to install and use the Confluent CLI, and access Confluent support and tools from options located at the bottom of the navigation menu.  ## How do I install the CLI from Cloud Console? Choose **CLI and tools**, located at the bottom of the navigation menu. Select the **Confluent CLI** tab for step-by-step instructions to install and access your Confluent Cloud environment with the Confluent CLI. For more information about how to install and use the Confluent CLI, see [Confluent CLI](https://docs.confluent.io/confluent-cli/current/install.html#cli-install). ## How do I access support from Cloud Console? To access Confluent support, choose **Support** located at the bottom of the navigation menu. The support plans display, with your current plan indicated. See [Confluent Cloud support plans](https://www.confluent.io/confluent-cloud/support/) for details about the plans. ## How do I change my password in Cloud Console? 1. From the **Administration** menu, click **Settings** > **Reset password**. 2. An email will be sent to the email address associated with the account to reset your password.  ## How do I add users in Cloud Console? To add a user: 1. From the **Administration** menu, click **Accounts & access**, and click **+Add user**. 2. Enter an email address, select an **Access Role**, and choose a **Scope**. 3. Click **Review** and then **Create**. For more information, see [Local user: username/password](security/authenticate/user-identities/user-accounts/manage-local-user-accounts.md#local-user-username-password). ## How do I collect troubleshooting info about issues in Cloud Console? If issues occur in Cloud Console, consider generating a HAR file and uploading it to the [Confluent Community Slack channel](https://confluentcommunity.slack.com/archives/C05T5F96UQ7) or sending it to the [flink preview email address](mailto:flink-preview@confluent.io). For more information, see [Generate a HAR file for Troubleshooting on Confluent Cloud](release-notes/generate-har-file.md#ccloud-har-file). ## Can I create a custom DNS name for Confluent Cloud bootstrap endpoints? You must use the original cluster bootstrap endpoint name. If you change the bootstrap name by creating a DNS record, TLS hostname validation fails. Confluent Cloud does not support custom DNS names. Custom DNS names are domain names that you configure to point to your Confluent Cloud cluster. ## How can I delete my account? When you delete your Confluent Cloud organization, you permanently remove all data and resources associated with it. To delete your local Confluent Cloud account, follow the steps in [Delete an organization](security/access-control/hierarchy/organizations/cloud-organization.md#delete-organization). ## How can I provide feedback for Confluent documentation? To provide feedback on the Confluent documentation, click the **Give us feedback** button located near the footer of each page. ## How do I sign up for Confluent Cloud in Jio regions? To get access to Confluent Cloud as a Jio customer, you must contact Confluent Cloud support. You must be a Jio customer to use Confluent Cloud in Jio regions. Create your Confluent account, then then email `jio-onboarding@confluent.io` with your Jio subscription id and your Confluent Cloud organization id to deploy resources in Jio region. ## Does Cloud Console have dark mode? Dark mode is available in Cloud Console. With dark mode, you can set your color theme to dark, light, or system. System uses the color theme of your computer for the color theme in Cloud Console. If you want to disable or turn off dark mode, use the following procedure: **To manage color theme**: 1. Sign in to Confluent Cloud. 2. From **Administration**, select your name (Settings). 3. Select **Preferences**. 4. In **Color Theme**, choose one of the following: - Light Mode - Dark Mode - System Preferences ## Is there a way to connect to a Confluent Cloud cluster using Confluent CLI and an API key? Yes, you can connect to Confluent Cloud using the [CLI](https://docs.confluent.io/confluent-cli/current/connect.html) and an API key. For more information, see [Connect Confluent CLI to Confluent Cloud Cluster](https://docs.confluent.io/confluent-cli/current/connect.html). ## Can I configure a source connector to pull from a private PostgreSQL database? Yes, however you must first set up PrivateLink or a public IP allowlist depending on your database network setup. ## How do I get access to Health+ to monitor Confluent Platform? [Health+](/platform/current/health-plus/index.html) is offered as a service that includes free access to basic features, with the option to upgrade to the paid tier for the full range of Health+ benefits. You can enable it by using the Health+ tab in your Cloud Console, or contact support for provisioning. For more information, see [Monitor Confluent Platform with Health+](/platform/current/health-plus/index.html). ## Can I use the same API key across different environments in Confluent Cloud? No, you cannot use the same API key across different environments in Confluent Cloud. API keys are scoped to specific Kafka clusters and environments. You need to generate separate API keys per environment. For more information, see [Use API Keys to Authenticate to Confluent Cloud](security/authenticate/workload-identities/service-accounts/api-keys/overview.md#api-keys-overview). ## How do I get alerted when a connector stops or fails? To get alerts for connector failures, use [Connector notifications and state transitions](monitoring/configure-notifications.md#ccloud-connector-notifications). For more information, see [Notifications for Confluent Cloud](monitoring/configure-notifications.md#ccloud-notifications). ## Is there a way to view API usage metrics or limits? Confluent Cloud does not expose detailed API usage stats currently. You can use [audit logs](monitoring/audit-logging/cloud-audit-log-concepts.md#cloud-audit-logs) and CLI scripts to monitor usage manually. ## Is it possible to use REST Proxy to produce messages in Confluent Cloud? Yes, REST Proxy is supported. Use the API endpoint structure with required headers including cluster ID and credentials. For more information, see [Connect Self-Managed REST Proxy to Confluent Cloud](cp-component/kafka-rest-config.md#cloud-kafka-rest-config). ## Can I use the Kafka REST API to produce schema-validated messages? No, the Kafka REST API currently supports only `BINARY`, `JSON`, and `STRING` formats, so it doesn’t support Schema Registry validation of produced messages against Avro, Protobuf, or JSON Schema. For more information, see [Kafka REST API Quick Start for Confluent Cloud](kafka-rest/krest-qs.md#cloud-rest-api-quickstart). ## How can I set up custom RBAC roles beyond the predefined ones? Custom roles are not currently supported. You can combine existing [RBAC roles](security/access-control/rbac/overview.md#rbac-overview) with resource scoping to meet most needs. ## Can I use Confluent Cloud within a private VPC using PrivateLink? Yes, PrivateLink is supported for AWS. You need to create VPC endpoints in supported regions. For more information, see [AWS PrivateLink Overview in Confluent Cloud](networking/aws-privatelink-overview.md#cloud-networking-aws-privatelink-overview). ## How do I ensure a connector writes data with specific field mappings to a database? Use transforms and custom mappings in the connector configuration. For more information, see the [Single Message Transformation (SMT) documentation](connectors/single-message-transforms.md#cc-single-message-transforms). ## Can I set schema compatibility to “none” for a subject in Schema Registry? Yes, this can be set using the Cloud Console, Confluent CLI, or Schema Registry REST API. For more information, see [Compatibility types](sr/fundamentals/schema-evolution.md#sr-compatibility-types). ## Is it possible to change a connector’s configuration without stopping it? Most configuration changes require pausing and restarting the connector, however, some minor changes may apply dynamically. For more information, see [Confluent Cloud API for Connect Usage Examples](connectors/connect-api-section.md#ccloud-connect-api). ## How do I ingest data from Google Cloud Storage to Confluent Cloud? Set up the GCS Source Connector with proper bucket access and file format configuration. For more information, see [Google Cloud Storage Source Connector for Confluent Cloud](connectors/cc-gcs-source.md#cc-gcs-connect-source). ## What causes “schema not found” errors in a connector? Check the subject naming strategy and ensure the schema exists and is compatible in Schema Registry. For more information, see [Subject name strategy](sr/fundamentals/serdes-develop/index.md#sr-schemas-subject-name-strategy). ## Can I use the Azure Cosmos DB source connector with the API for MongoDB? No, the connector requires a Cosmos DB account configured for the Core (SQL) API. See the [prerequisites](connectors/cc-azure-cosmos-source-v2.md#cc-azure-cosmos-source-v2-prereqs) for the Azure Cosmos DB Source V2 connector. ## How do I ensure a sink connector doesn’t overwrite existing data in a database? Set insert mode to `insert` and disable `delete.enabled` in the connector configuration. ## How do I configure Confluent Cloud for multi-region failover? Use [Cluster Linking](multi-cloud/cluster-linking/index.md#cloud-cluster-linking) or multi-region producers for disaster recovery. ## Can I encrypt messages end-to-end, beyond TLS in transit? Message encryption at rest is enabled by default. For additional security, you can implement [client-side encryption](security/encrypt/csfle/overview.md#csfle-overview). ## How can I create a schema with optional fields in Protobuf? Use Protobuf syntax and mark fields as optional using the `optional` keyword in your schema definition. For more information, see [Protobuf Schema Serializer and Deserializer for Schema Registry on Confluent Cloud](sr/fundamentals/serdes-develop/serdes-protobuf.md#serdes-and-formatter-protobuf). ## Why does Flink turn an update into a delete and insert event? This happens when a change data capture (CDC)-sourced table’s `changelog.mode` doesn’t correctly interpret update operations. Set `changelog.mode` to `retract` so Flink processes update events as `UPDATE_BEFORE` and `UPDATE_AFTER` messages instead of separate delete and insert events. For requirements and configuration details, see [Changelog modes](flink/reference/serialization.md#flink-sql-changelog-modes). ## How do I upload a JAR file to use with a Flink compute pool? Package your custom function into a JAR or Python package, upload it as an artifact to Confluent Cloud, and register it with a `CREATE FUNCTION` statement to use it as a user-defined function (UDF) in Flink SQL. For steps, see [Create a User-Defined Function with Confluent Cloud for Apache Flink](flink/how-to-guides/create-udf.md#flink-sql-create-udf). ## Related content - For information about using Confluent AI Assistant in your organization, see: [Confluent AI Assistant for Confluent Cloud](release-notes/cflt-assistant.md#cloud-ai) - For more billing and pricing details, see: [Confluent Cloud Pricing Details](https://www.confluent.io/confluent-cloud/pricing/) - For an estimate of your costs, see: [Confluent Cost Estimator](https://www.confluent.io/pricing/cost-estimator/) - For more information on the Metrics API, see: [API Reference](https://api.telemetry.confluent.cloud/docs) - For a comprehensive list of available metrics, see: [Metrics Reference](https://api.telemetry.confluent.cloud/docs/descriptors/datasets/cloud) - For frequently asked questions specifically about Confluent metrics, see: [Confluent Metrics FAQ](monitoring/monitor-faq.md#metrics-api-faq) - For more information about the security capabilities of Confluent Cloud, see: [Confluent’s Trust Center](https://confluent.safebase.us/?product=default)