<a id="connections-overview"></a>

# Reuse Confluent Cloud Connections With External Services

Connections in Confluent Cloud are resources that you configure to establish the
parameters necessary for connecting to third-party services. Each Connection
includes:

* Endpoint information (such as the URL or address of the external service)
* Authentication information (such as credentials or identity provider details)

Connections handle sensitive data securely (keeping passwords obfuscated
and protected) and allow reuse across different applications, such as
Flink AI and Flink UDFs, provided that proper permissions are granted.

## When to use connections

Use connections when you need to:

* **Integrate with AI/ML services**: Connect to services like OpenAI, Amazon Bedrock,
  or Azure OpenAI for real-time data enrichment and AI processing.
* **Store and retrieve data**: Connect to databases like MongoDB, Couchbase, or
  search engines like Elastic for data storage and retrieval.
* **Reuse configurations**: Share connection settings across multiple Flink
  applications without duplicating sensitive credentials.
* **Maintain security**: Centrally manage authentication credentials and apply
  consistent security policies.
* **Enable vector operations**: Connect to vector databases like Pinecone for
  similarity search and retrieval-augmented generation (RAG) workflows.

Connections are particularly useful in streaming scenarios where you need to
enrich real-time data with external services or store processed results in
external services.

## Connection details

A reusable connection in Confluent Cloud includes the following information:

- [Service](#connection-service)
- [REST endpoint](#connection-rest-endpoint)
- [Authentication method](#connection-authentication-method)

<a id="connection-service"></a>

### Service

The service is the type of external service to connect to. These services
include AI/ML services and databases. Each service has a unique service
code (connection type). For a listing of supported external services and
configuration parameters, see [External Services for Confluent Cloud Connections](services.md#connections-services).

<a id="connection-rest-endpoint"></a>

### REST endpoint

The specific REST endpoint or address for the external service. You can get
the REST endpoint for a connection from the service provider’s documentation.

Examples of endpoints for supported services:

* **OpenAI**: `https://api.openai.com/v1/chat/completions`
* **Amazon Bedrock**: `https://bedrock-runtime.us-east-1.amazonaws.com`
* **Azure OpenAI**: `https://your-resource.openai.azure.com/openai/deployments/your-model/chat/completions`
* **MongoDB**: `mongodb+srv://cluster0.example.mongodb.net`
* **Pinecone**: `https://your-index-name.svc.environment.pinecone.io`
* **Elastic**: `https://your-deployment.es.region.cloud.es.io`

<a id="connection-authentication-method"></a>

### Authentication method

The authentication method defines how the connection is authenticated to the
external service. Choose an authentication method based on your security
requirements:

| Security strength   | Authentication methods                                                                                                                                                                                                                                                                                                                                                                                                                                |
|---------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| **High**            | * [AWS Identity and Access Management (IAM)](https://aws.amazon.com/iam/)<br/>* [Azure managed identities](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview)<br/>* [Google CloudWorkload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation)<br/>* OAuth 2.0 authorization code grant (credential-less/managed identity)                                         |
| **Moderate**        | * Username/password stored in:<br/>  <br/><br/>  • [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/)<br/>  <br/><br/>  • [Azure Key Vault](https://learn.microsoft.com/en-us/azure/key-vault/general/overview)<br/>  <br/><br/>  • [Google Secrets Manager](https://cloud.google.com/secret-manager/docs/overview)<br/>  <br/><br/>* OAuth 2.0 client credentials grant<br/>* OAuth 2.0 authorization code grant with stored credentials |
| **Low**             | * Username/password<br/>* Service accounts                                                                                                                                                                                                                                                                                                                                                                                                            |

## Connection resource scope

Connection resources are scoped to their parent Confluent Cloud environment. Only
applications in the same Confluent Cloud environment can be granted access to a
connection resource.

- Connection resources cannot be shared across Confluent Cloud environments.
- Connection resources are regional, meaning they are specific to a supported
  Confluent Cloud region. Applications in different regions cannot access the same
  connection resource.
- When using private networking, a connection can use networking resources
  (including networks and access points) in the same Confluent Cloud environment.

## Prerequisites

Before creating a connection, ensure you have the following:

* **Service provider account**: An active account with the external service you
  want to connect to.
* **Authentication credentials**: Valid credentials for the service (API keys,
  access keys, or service account credentials).
* **Endpoint information**: The correct REST endpoint URL for your service
  instance.
* **Network access**: Appropriate network connectivity between Confluent Cloud and the
  external service.
* **Required permissions**: One of the Confluent Cloud roles listed in the
  [Security](#connections-security) section below.

#### NOTE
Some services may require additional setup, such as creating API keys, configuring
IAM roles, or enabling specific service features. Refer to the service provider’s
documentation for detailed setup instructions.

<a id="connections-security"></a>

## Security

To create a connection, you need to be granted one of the following Confluent Cloud
RBAC roles:

* [OrganizationAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#organizationadmin-role)
* [EnvironmentAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#environmentadmin-role)
* [CloudClusterAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#cloudclusteradmin-role)
* [FlinkAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#flinkadmin-role)
* [FlinkDeveloper](../../security/access-control/rbac/predefined-rbac-roles.md#flinkdeveloper-role)

When a user with one of these roles creates a connection, they can optionally assign
a [ResourceOwner](../../security/access-control/rbac/predefined-rbac-roles.md#resourceowner-role) role to another user.

**Security best practices**

* Use the highest security authentication method available for your service.
* Regularly rotate API keys and access credentials.
* Apply the principle of least privilege when configuring service permissions.
* Monitor connection usage through Confluent Cloud audit logs.
* Use private networking when available to reduce exposure over the public internet.

#### NOTE
All endpoints require authentication and appropriate permissions. Sensitive
fields (such as API keys) are obfuscated in responses.

## Next steps

1. **Plan your integration**: Identify which external services you need to connect to and review their authentication requirements.
2. **Set up credentials**: Obtain the necessary API keys, access keys, or configure managed identities for your chosen services.
3. **Create connections**: Follow the instructions in [Manage Connections with External Services in Confluent Cloud](manage-connections.md#manage-connections) to create and configure your connections.
4. **Test your setup**: Verify connectivity and authentication before using connections in production applications.
5. **Implement security**: Apply best practices for credential management and access control.

## Related content

- [External Services for Confluent Cloud Connections](services.md#connections-services)
- [Manage Connections with External Services in Confluent Cloud](manage-connections.md#manage-connections)
- [AWS IAM Role-Based Authorization Quick Start for Confluent Cloud](../../connectors/provider-integration.md#cloud-pi-quickstart)
- [How to generate vector embeddings for RAG (GenAI) with Flink SQL in Confluent Cloud [Confluent Developer]](https://developer.confluent.io/confluent-tutorials/gen-ai-vector-embedding/flinksql/)
- [Flink AI: Real-Time ML and GenAI Enrichment of Streaming Data with Flink SQL on Confluent Cloud [Confluent Blog]](https://www.confluent.io/blog/flink-ai-real-time-ml-and-genai-enrichment-of-streaming-data-with-flink-sql-on-confluent-cloud/)