# Manage Provider Integrations in Confluent Cloud After you create a provider integration in Confluent Cloud with your cloud service provider, you can manage the provider integration in Confluent Cloud using the Confluent Cloud Console, Confluent CLI, and Confluent Cloud APIs. The following sections describe how to list, describe, and delete provider integrations using each method. Provider integrations are supported for: - AWS IAM roles ([create](create-provider-integration-aws.md#create-provider-integration-aws)) - Google Cloud service accounts ([create](create-provider-integration-gc.md#create-provider-integration-gc)) - Microsoft Entra ID ([create](create-provider-integration-azure.md#create-provider-integration-azure)) ## List provider integrations You can list all provider integrations in an environment using the Confluent Cloud Console, Confluent CLI, or Confluent Cloud APIs. ### Cloud Console 1. Open the Confluent Cloud Console at [https://confluent.cloud](https://confluent.cloud). 2. Go the the environment where you want to list integrations for. 3. Select **Integrations** > **Provider Integrations**. The Confluent Cloud Console displays a list of all provider integrations in the environment. ### Confluent CLI To list all provider integrations in an environment, use the `confluent provider-integration list` CLI command: ```shell # List all provider integrations confluent provider-integration list # List only AWS provider integrations confluent provider-integration list --provider AWS # List only Google Cloud provider integrations confluent provider-integration list --provider GCP ``` For details on the `confluent provider-integration list` CLI command, see [confluent provider-integration list](https://docs.confluent.io/confluent-cli/current/command-reference/provider-integration/confluent_provider-integration_list.html#confluent-provider-integration-list) in the Confluent CLI Command Reference. ### REST API To list all provider integrations in an environment, use the GET request: ```shell # List all provider integrations curl --request GET 'https://api.confluent.cloud/pim/v1/integrations?environment={environment-id}' \ --header 'Authorization: Basic ' | jq # List only AWS provider integrations curl --request GET 'https://api.confluent.cloud/pim/v1/integrations?provider=AWS&environment={environment-id}' \ --header 'Authorization: Basic ' | jq # List only Google Cloud provider integrations curl --request GET 'https://api.confluent.cloud/pim/v1/integrations?provider=GCP&environment={environment-id}' \ --header 'Authorization: Basic ' | jq ``` Replace {environment-id} with your environment ID and with your API key and secret encoded in base64. For details on using the Provider Integration API to list provider integrations, see [List of Integrations [Integrations (pim/v1)]](https://docs.confluent.io/cloud/current/ccloud/list-pim-v-1-integrations/) in the Confluent Cloud APIs Reference. ## Describe a provider integration You can describe a provider integration in an environment using the Confluent Cloud Console, Confluent CLI, or Confluent Cloud APIs. ### Cloud Console To see the details of a provider integration using the Confluent Cloud Console: 1. Open the Confluent Cloud Console at [https://confluent.cloud](https://confluent.cloud). 2. Go the the environment where you want to list integrations for. 3. Select **Integrations** > **Provider Integrations**. 4. Select the integration to view its details. ### Confluent CLI To see the details of a provider integration using the Confluent CLI, use the `confluent provider-integration describe` CLI command: ```shell confluent provider-integration describe --id ``` Replace with the ID of the integration you want to describe. For details on the `confluent provider-integration describe` CLI command, see [confluent provider-integration describe](https://docs.confluent.io/confluent-cli/current/command-reference/provider-integration/confluent_provider-integration_describe.html#confluent-provider-integration-describe) in the Confluent CLI Command Reference. ### REST API To see the details of a provider integration using the REST API, use the GET request: ```shell curl --request GET \ --url 'https://api.confluent.cloud/pim/v1/integrations/{id}?environment={environment-id}' \ --header 'Authorization: Basic ' | jq ``` Replace {id} with the integration ID and {environment-id} with your environment ID. ## Update a provider integration Updating a provider integration is not supported. To update the configuration, delete and recreate the integration with the desired parameters. #### NOTE **Cloud-specific considerations for updates:** - **AWS integrations**: When recreating, you can reuse the same IAM role but must update the trust policy with new Confluent values - **Google Cloud integrations**: When recreating, you can reuse the same service account but must update the impersonation policy with the new Confluent service account email ## Delete a provider integration You can delete a provider integration in an environment using the Confluent Cloud Console, Confluent CLI, or Confluent Cloud APIs. #### NOTE A delete request fails if any Confluent Cloud workloads are using the provider integration. #### IMPORTANT **Post-deletion cleanup:** After deleting a provider integration, consider cleaning up the cloud-side resources: - **AWS**: The IAM role remains in your AWS account. You can delete it or remove the trust policy to prevent future access - **Google Cloud**: The service account remains in your Google Cloud project. You can delete it or remove the impersonation policy binding to prevent future access ### Cloud Console To delete a provider integration using the Confluent Cloud Console: 1. Open the Confluent Cloud Console at [https://confluent.cloud](https://confluent.cloud). 2. Go the the environment where you want to delete the integration. 3. Select **Integrations** > **Provider Integrations**. 4. Select the integration to delete. 5. Click **Delete**. The Confluent Cloud Console displays a confirmation message. ### Confluent CLI To delete a provider integration using the Confluent CLI, run the `confluent provider-integration delete` CLI command: ```shell confluent provider-integration delete \ --id ``` Replace with the ID of the integration you want to delete. For details on the `confluent provider-integration delete` CLI command, see [confluent provider-integration delete](https://docs.confluent.io/confluent-cli/current/command-reference/provider-integration/confluent_provider-integration_delete.html) in the Confluent CLI Command Reference. ### REST API To delete a provider integration using the REST API, use the DELETE request: ```shell curl --request DELETE \ --url 'https://api.confluent.cloud/pim/v1/integrations/{id}?environment={environment-id}' \ --header 'Authorization: Basic ' | jq ``` Replace {id} with the integration ID and {environment-id} with your environment ID. For details on using the Provider Integration API to delete a provider integration, see [Delete an Integration [Integrations (pim/v1)]](https://docs.confluent.io/cloud/current/ccloud/delete-pim-v-1-integration/) in the Confluent Cloud APIs Reference. ## Troubleshoot provider integration management ### Common management issues and solutions **Integration appears in list but describe fails** This can happen when cloud-side permissions have been modified after integration creation. **AWS-specific solutions:** - Verify the IAM role still exists in your AWS account - Check that the trust policy still allows Confluent Cloud access - Ensure the IAM role has not been deleted or modified **Google Cloud-specific solutions:** - Verify the service account still exists in your Google Cloud project - Check that the impersonation policy still grants access to the Confluent service account - Ensure the service account has not been disabled or deleted **Integration deletion fails with “Integration in use”** **Solution:** #. List all connectors in the environment: `confluent connect cluster list` #. Check each connector’s configuration for the integration ID #. Delete or reconfigure connectors that use the integration #. Retry the integration deletion **Provider integration works intermittently** **AWS-specific troubleshooting:** - Check AWS CloudTrail logs for AssumeRole failures - Verify external ID has not been changed - Check for IP-based conditional policies that might be blocking access **Google Cloud-specific troubleshooting:** - Check Google Cloud Audit Logs for impersonation failures - Verify service account email has not changed - Check for conditional access policies that might be blocking access - Test impersonation manually: `gcloud auth print-access-token --impersonate-service-account=` **Best practices for ongoing management** **Monitoring and maintenance:** - Set up alerts for integration authentication failures - Regularly audit cloud-side permissions - Monitor integration usage across connectors - Keep documentation of which integrations are used by which connectors **Security hygiene:** - Regularly rotate cloud credentials (service account keys, if used) - Review and audit integration permissions quarterly - Remove unused integrations promptly - Use least-privilege principles when granting permissions ## Related content **Provider integration creation:** - [Create an AWS Provider Integration](create-provider-integration-aws.md#create-provider-integration-aws) - [Create a Google Cloud Provider Integration](create-provider-integration-gc.md#create-provider-integration-gc) - [Create an Azure Provider Integration](create-provider-integration-azure.md#create-provider-integration-azure) **API and CLI reference:** - [Confluent Provider Integration CLI Command Reference](https://docs.confluent.io/confluent-cli/current/command-reference/provider-integration/index.html) - [Confluent Provider Integration API Reference](https://docs.confluent.io/cloud/current/ccloud/integrations-pim-v-1/) **Quick start guide:** - [Manage Provider Integration for Fully Managed Connectors](../../connectors/provider-integration.md#cloud-pi-quickstart)