Flink Authentication and Authorization Auditable Event Methods on Confluent Cloud

An auditable event is an authentication or authorization operation in Confluent Cloud. When an auditable event occurs, it generates a message that Confluent Cloud stores as an audit log record.

For management and operations events for Flink, see Flink Management and Operations Auditable Event Methods on Confluent Cloud.

Flink region authentication

The flink.Authenticate method authenticates a client to an Apache Flink® region. It generates an auditable event message for the io.confluent.flink.server/authentication event type.

Method name	Action triggering an auditable event message
flink.Authenticate	A request for authentication to a Flink region.

flink.Authenticate

The flink.Authenticate event is generated by a request to authenticate to a Flink region.

To view an example event message, expand the following dropdown:

Flink authorization

The flink.Authorize method authorizes principals, such as user and service accounts, to access, modify, delete, or create a Flink resource. It generates an auditable event message for the io.confluent.flink.server/authorization event type.

Method name	Action triggering an auditable event message
flink.Authorize	A request to authorize a principal to access, modify, delete, or create a Flink resource.

flink.Authorize

The flink.Authorize event is generated by a request to authorize a principal to access, modify, delete, or create a Flink resource (STATEMENT or WORKSPACE).

To view an example event message, expand the following dropdown:

Success

{
    "cloudResources": [
        {
            "scope": {
                "resources": [
                    {
                        "resourceId": "49aea135-19f4-4e75-adb3-8ca5dd04e292",
                        "type": "ORGANIZATION"
                    },
                    {
                        "resourceId": "env-3ny01o",
                        "type": "ENVIRONMENT"
                    },
                    {
                        "resourceId": "azure.eastus2",
                        "type": "FLINK_REGION"
                    }
                ]
            },
            "resource": {
                "resourceId": "workspace-2024-03-07-030236-92003e1d-1abf-4401-bbfb-57b6b9ead5de",
                "type": "STATEMENT"
            }
        }
    ],
    "authorizationInfo": {
        "resourceName": "workspace-2024-03-07-030236-92003e1d-1abf-4401-bbfb-57b6b9ead5de",
        "operation": "Describe",
        "resourceType": "STATEMENT",
        "rbacAuthorization": {
            "patternType": "LITERAL",
            "resourceType": "Statement",
            "actingPrincipal": {
                "group": {
                    "resourceId": "group-Xmgn"
                }
            },
            "role": "FlinkAdmin",
            "patternName": "*",
            "operation": "Describe",
            "cloudScope": {
                "resources": [
                    {
                        "resourceId": "49aea135-19f4-4e75-adb3-8ca5dd04e292",
                        "type": "ORGANIZATION"
                    },
                    {
                        "resourceId": "env-3px32m",
                        "type": "ENVIRONMENT"
                    }
                ]
            }
        },
        "result": "ALLOW"
    },
    "request": {
        "accessType": "READ_ONLY"
    },
    "internalServiceName": "crn://confluent.cloud/organization=49afb126-18f4-4e76-adb3-8ca5dd04e393/environment=env-3px32m/flink-region=azure.eastus2",
    "authenticationInfo": {
        "exposure": "CUSTOMER",
        "identity": "crn://confluent.cloud/organization=49afb126-18f4-4e76-adb3-8ca5dd04e393/identity-provider=Confluent/identity=u-nqxk78",
        "principal": {
            "confluentUser": {
                "resourceId": "u-nqxk78"
            }
        },
        "result": "SUCCESS"
    },
    "serviceName": "crn://confluent.cloud/organization=49afb126-18f4-4e76-adb3-8ca5dd04e393/environment=env-3px32m/flink-region=azure.eastus2",
    "methodName": "flink.Authorize",
    "requestMetadata": {
        "requestId": [
            "52107f4df7fce0356e278c20ce143418"
        ],
        "clientAddress": [
            {
                "ip": "1.2.3.4.5"
            }
        ]
    },
    "result": {
        "status": "SUCCESS"
    }
}