Grant Role-Based Access in SQL

Confluent Cloud for Apache Flink®️ supports Role-based Access Control (RBAC) for managing Flink resources. These roles are supported:

• FlinkAdmin: Grant the FlinkAdmin role to a user account to enable full access to Flink resources in an environment. The FlinkAdmin role is bound at the environment level.
• FlinkDeveloper: Grant the FlinkDeveloper role to a user account to enable limited access to Flink resources in an environment. It should be given to users who run Flink statements but don’t manage compute pools. The FlinkDeveloper role can be bound at both the environment and compute-pool level.
• Assigner: Grant the Assigner role to a user account that needs a role binding on a service account to run Flink statements with a service principal.

The account that gets the role is referred to as the principal. For more information, see Manage RBAC role bindings in Confluent Cloud.

Use the CLI reference command to grant permissions to users for Flink resources.

Important

Confluent Cloud for Apache Flink®️ is currently available for Preview. A Preview feature is a Confluent Cloud component that is being introduced to gain early feedback from developers. Preview features can be used for evaluation and non-production testing purposes or to provide feedback to Confluent. The warranty, SLA, and Support Services provisions of your agreement with Confluent do not apply to Preview features. Confluent may discontinue providing Preview releases of the Preview features at any time in Confluent’s sole discretion. Check out Getting Help for questions, feedback and requests.

For SQL features and limitations in the preview program, see Notable Limitations in Public Preview.

Authorization

Users

Users must be authorized to use a compute pool.

Compute pools

Compute pools are a resource that can be authorized, for example, a user with the EnvironmentAdmin role edit a compute pool. But a compute pool is not a principal, for example, Compute Pool lfcp-abc123 doesn’t make calls to other resources, so the compute pool itself doesn’t need an identity with role bindings, in contrast with statements.

A compute pool doesn’t have any permissions and isn’t a security principal, because a compute budget knows nothing about the workloads run on it.

Statements

The FlinkAdmin and FlinkDeveloper roles control access to compute resources in a compute pool. Access to data is controlled by the Apache Kafka® data access model, and data permissions are determined by the roles granted to the principal.

The hierarchy at which a statement exists doesn’t constrain the data it can access. A statement’s access level is determined entirely by the permissions that you attach to the statement. For more information, see Grant Role-Based Access in SQL.

Statements can access any data, across environments, and eventually orgs, that the permissions attached by the user are authorized to access.

This includes all statements:

• DML statements that run on Flink, like SELECT * FROM …
• DDL statements, like CREATE TABLE
• Metadata queries, like SHOW TABLES

Administrator

Run the following command to log in to Confluent Cloud with an EnvironmentAdmin or FlinkAdmin account by using the Confluent CLI.

confluent login --save --organization-id ${ORG_ID}

Grant the FlinkAdmin role to a user

Run the following Confluent CLI command as an Admin to grant the FlinkAdmin role to a user with the identifier USER_ID.

confluent iam rbac role-binding create \
  --environment ${ENV_ID} \
  --principal User:${USER_ID} \
  --role FlinkAdmin

Grant a user access to all compute pools in an environment

Run the following Confluent CLI command as an Admin to grant the FlinkDeveloper role to a user for broad access to all compute pools in an environment.

confluent iam rbac role-binding create \
  --environment ${ENV_ID} \
  --principal User:${USER_ID} \
  --role FlinkDeveloper

Grant a user access to a compute pool

Run the following Confluent CLI command as an Admin to grant granular access to one compute pool for a user.

confluent iam rbac role-binding create \
  --environment ${ENV_ID} \
  --flink-region ${FLINK_REGION} \
  --resource ComputePool:${COMPUTE_POOL_ID} \
  --principal User:${USER_ID} \
  --role FlinkDeveloper

Note

You can only grant the FlinkDeveloper role on an environment by using the Confluent Cloud Console. To grant the FlinkDeveloper role on a compute pool, use Confluent CLI commands or the REST API.

Grant a service account and user permission to run SQL statements

Run the following Confluent CLI commands as an Admin to grant permission for a service account to run SQL statements.

In this case, you grant a service account DeveloperWrite permissions to a Kafka cluster, then you grant a user Assigner permissions to the service account.

1. Create the service account. Optionally, you can use an existing service account in the environment.

   confluent iam service-account create \
     ${SA_NAME} \
     –-description ${SA_DESCRIPTION}
   

2. Grant permission for the service account to access resources on the Kafka cluster. In this context, the service account is acting as an identity.

   confluent iam rbac role-binding create \
     --principal User:${SA_NAME} \
     --environment ${ENV_ID} \
     --role EnvironmentAdmin
   

3. Grant a user the Assigner role to access the service account. In this context, the service account is acting as a resource.

   confluent iam rbac role-binding create \
     --principal User:${USER_ID} \
     --resource service-account:${SERVICE_ACCOUNT_ID} \
     --role Assigner
   

Submit long-running statements

To start long-running statements, log in to the SQL shell with a service account. If you log in with your user account, your statements run for only four hours before they’re terminated.

Specify the --service-account option when you start the SQL shell to enable submitting long-running statements. You must have the Assigner role.

confluent flink shell \
  --compute-pool ${COMPUTE_POOL_ID} \
  --environment ${ENV_ID} \
  --service-account ${SERVICE_ACCOUNT_ID}

If you start the SQL shell with your user account, you can still start long-running statements by setting the SERVICE_ACCOUNT shell property.

SET SERVICE_ACCOUNT = '<service-account-id>';

The specified service account identifier is cached in the shell client and isn’t validated when you make the assignment. If the identifier references a service account that doesn’t have access to compute pool resources, you’ll get an error why you try to submit a statement.

Topic schemas

For principals without OrganizationAdmin or EnvironmentAdmin privileges to access a topic that’s created by a CREATE TABLE statement in the SQL shell, you must manually grant the DeveloperWrite role for the corresponding Schema Registry subject to enable reading from or writing to the topic.

Audit log events

Auditable event methods for the FLINK_WORKSPACE and STATEMENT resource types are triggered by operations on a Flink workspace and generate event messages that are sent to the audit log cluster, where they are stored as event records in a Kafka topic.

For more information, see Flink Auditable Event Methods.

Related content

• Statements in Confluent Cloud
• Role-based Access Control (RBAC) in Confluent Cloud
• Service Accounts for Confluent Cloud

Note

This website includes content developed at the Apache Software Foundation under the terms of the Apache License v2.