# Grant Role-Based Access to ksqlDB on Confluent Cloud ksqlDB supports role-based access control (RBAC) for managing ksqlDB clusters. Assign the KsqlAdmin role to a user account or a service principal to grant access to a specific ksqlDB cluster in Confluent Cloud. The account that gets the role is referred to as the “principal”. A principal that has the KsqlAdmin role to a ksqlDB cluster has full access to all resources on the cluster, like streams and persistent queries. Also, the KsqlAdmin role enables listing and terminating the cluster. The KsqlAdmin role does not grant permission to create ksqlDB clusters. Only accounts that have the CloudClusterAdmin, EnvironmentAdmin, or OrganizationAdmin role can grant the KsqlAdmin role. A principal with one of these roles can create the ksqlDB cluster and assign the KsqlAdmin role to the principals who will use the ksqlDB cluster. If the ksqlDB cluster has topics with Avro, Protobuf, or JSON_SR schemas, you need the ID of the Schema Registry cluster and an associated role binding. For more information, see [Enable ksqlDB Integration with Schema Registry on Confluent Cloud](integrate-ksqldb-with-schema-registry.md#cloud-ksqldb-integrate-with-schema-registry). For more information on limitations of the KsqlAdmin role, see [Limitations](../security/access-control/rbac/predefined-rbac-roles.md#cloud-rbac-limitations). Use the [Confluent CLI](https://docs.confluent.io/confluent-cli/current/command-reference/iam/rbac/role-binding/confluent_iam_rbac_role-binding_create.html) or Confluent Cloud Console to create roles for users. ## Assign roles for ksqlDB access by using the Confluent CLI Use the example command in this section to grant access to a ksqlDB cluster. To grant KsqlAdmin permissions, you must have the CloudClusterAdmin, EnvironmentAdmin, or OrganizationAdmin role. You need the cluster ID of the Kafka cluster, the friendly name of the ksqlDB cluster, and the ID of the environment. #### NOTE Unlike other Confluent CLI RBAC commands, the command for creating a KsqlAdmin role binding requires the friendly name of the ksqlDB cluster, not the cluster ID. To get the cluster name, run the following command: ```bash confluent ksql cluster list ``` Your output should resemble: ```none ID | Name | Topic Prefix | Kafka Cluster | Storage | ----------------+------------------+--------------+--------------------+---------+ ... lksqlc-123abc | ksqlDB_cluster_0 | pksqlc-ab123 | lkc-456def | 25 | ``` In the example output, the ksqlDB cluster name is `ksqlDB_cluster_0`. Run the following command to grant the KsqlAdmin role to a principal to enable access to the specified ksqlDB cluster. Any user account or service principal that doesn’t have the KsqlAdmin role isn’t able to list the cluster or access resources on the cluster. ```bash confluent iam rbac role-binding create \ --principal User: \ --role KsqlAdmin \ --environment \ --cloud-cluster \ --ksql-cluster ``` ### Grant the KsqlAdmin role to a user The following steps show how to grant the KsqlAdmin role to a user. 1. Log in as an OrganizationAdmin user and list your role bindings: ```bash confluent iam rbac role-binding list --principal User: ``` 2. Create a KsqlAdmin role binding for the selected principal: ```bash confluent iam rbac role-binding create --principal User: \ --role KsqlAdmin \ --environment \ --cloud-cluster \ --ksql-cluster ``` 3. Log in using Confluent CLI with the credentials of the KsqlAdmin principal and list the principal’s role-bindings: ```bash confluent iam rbac role-binding list --principal User: ``` 4. Create an API key: ```bash confluent api-key create --resource \ --description "ksqlDB demo" ``` 5. Connect to ksqlDB: ```bash ksql --user --password https://:443 ``` 6. In the ksqlDB CLI, run a query to verify access: ```sql show streams; ``` If the ksqlDB cluster requires access to Schema Registry, you must grant the **ResourceOwner** role to the principal. For more information, see [Enable ksqlDB Integration with Schema Registry on Confluent Cloud](integrate-ksqldb-with-schema-registry.md#cloud-ksqldb-integrate-with-schema-registry). ## Assign roles for ksqlDB access by using the Confluent Cloud Console To grant KsqlAdmin permissions, you must have the CloudClusterAdmin, EnvironmentAdmin, or OrganizationAdmin role. 1. In the Confluent Cloud Console, click the Administration menu in the upper-right corner:![admin-menu-icon](images/ccloud-admin-menu-icon.png) 2. In the Administration menu, click **Accounts & access**. 3. In the **Accounts & access** page, select **User accounts** or **Service accounts**. 4. Click **Access**, and in the **Access** page, navigate to the **Organization > Environment > Cluster** that has the ksqlDB cluster. 5. Click **ksqlDb Clusters**. 6. In the **New ksqlDB cluster permissions** section, select the ksqlDB cluster that will get the KsqlAdmin role. 7. Select the **KsqlAdmin** role, and click **Save**. If the ksqlDB cluster requires access to Schema Registry, you must grant the **ResourceOwner** role to the principal. For more information, see [Enable ksqlDB Integration with Schema Registry on Confluent Cloud](integrate-ksqldb-with-schema-registry.md#cloud-ksqldb-integrate-with-schema-registry).