Flink Authentication and Authorization Auditable Event Methods on Confluent Cloud

Confluent Cloud audit logs contain records of auditable events for authentication and authorization operations. When an auditable event occurs, a message is sent to the audit log and is stored as an audit log record. For management and operations events for Flink, see Flink Management and Operations Auditable Event Methods on Confluent Cloud.

Flink region authentication

The following operations authenticate to an Apache Flink® region and generate auditable event messages for the io.confluent.flink.server/authentication event type.

Method name	Action triggering an auditable event message
flink.Authenticate	A request for authentication to a Flink region.

flink.Authenticate

The flink.Authenticate event is generated by a request to authenticate to a Flink region.

To view an example event message, expand the following dropdown:

Flink authorization

The following operations authorize principals, such as user and service accounts, to access, modify, delete, or create a Flink resource and generate auditable event messages for the io.confluent.flink.server/authorization event type.

Method name	Action triggering an auditable event message
flink.Authorize	A request to authorize a principal to access, modify, delete, or create a Flink resource.

flink.Authorize

The flink.Authorize event is generated by a request to authorize a principal to access, modify, delete, or create a Flink resource (STATEMENT or WORKSPACE).

To view an example event message, expand the following dropdown:

Success

{
    "cloudResources": [
        {
            "scope": {
                "resources": [
                    {
                        "resourceId": "49aea135-19f4-4e75-adb3-8ca5dd04e292",
                        "type": "ORGANIZATION"
                    },
                    {
                        "resourceId": "env-3ny01o",
                        "type": "ENVIRONMENT"
                    },
                    {
                        "resourceId": "azure.eastus2",
                        "type": "FLINK_REGION"
                    }
                ]
            },
            "resource": {
                "resourceId": "workspace-2024-03-07-030236-92003e1d-1abf-4401-bbfb-57b6b9ead5de",
                "type": "STATEMENT"
            }
        }
    ],
    "authorizationInfo": {
        "resourceName": "workspace-2024-03-07-030236-92003e1d-1abf-4401-bbfb-57b6b9ead5de",
        "operation": "Describe",
        "resourceType": "STATEMENT",
        "rbacAuthorization": {
            "patternType": "LITERAL",
            "resourceType": "Statement",
            "actingPrincipal": {
                "group": {
                    "resourceId": "group-Xmgn"
                }
            },
            "role": "FlinkAdmin",
            "patternName": "*",
            "operation": "Describe",
            "cloudScope": {
                "resources": [
                    {
                        "resourceId": "49aea135-19f4-4e75-adb3-8ca5dd04e292",
                        "type": "ORGANIZATION"
                    },
                    {
                        "resourceId": "env-3px32m",
                        "type": "ENVIRONMENT"
                    }
                ]
            }
        },
        "result": "ALLOW"
    },
    "request": {
        "accessType": "READ_ONLY"
    },
    "internalServiceName": "crn://confluent.cloud/organization=49afb126-18f4-4e76-adb3-8ca5dd04e393/environment=env-3px32m/flink-region=azure.eastus2",
    "authenticationInfo": {
        "exposure": "CUSTOMER",
        "identity": "crn://confluent.cloud/organization=49afb126-18f4-4e76-adb3-8ca5dd04e393/identity-provider=Confluent/identity=u-nqxk78",
        "principal": {
            "confluentUser": {
                "resourceId": "u-nqxk78"
            }
        },
        "result": "SUCCESS"
    },
    "serviceName": "crn://confluent.cloud/organization=49afb126-18f4-4e76-adb3-8ca5dd04e393/environment=env-3px32m/flink-region=azure.eastus2",
    "methodName": "flink.Authorize",
    "requestMetadata": {
        "requestId": [
            "52107f4df7fce0356e278c20ce143418"
        ],
        "clientAddress": [
            {
                "ip": "1.2.3.4.5"
            }
        ]
    },
    "result": {
        "status": "SUCCESS"
    }
}