Advanced Security add-on for Confluent Cloud
The Advanced Security add-on provides enterprise security capabilities for Confluent Cloud organizations. This add-on brings stronger identity, encryption, and access-control capabilities across your organization:
System for Cross-domain Identity Management (SCIM)-based user provisioning for supported single sign-on (SSO) workflows
Bring Your Own Key (BYOK) for supported resources
Higher identity and access management (IAM)-related limits for supported organization-scoped security resources
Note
The Advanced Security add-on is a Limited Availability feature in Confluent Cloud. It is fully supported and recommended for production use. Advanced Security will include additional features when generally available. Your OrganizationAdmins can enable the add-on in Confluent Cloud.
Higher limits included with the add-on
The Advanced Security add-on increases the following limits.
Resource or limit |
Default Confluent Cloud |
Advanced Security add-on |
|---|---|---|
OAuth identity pools per identity provider |
1,000 |
2,000 |
mTLS certificate identity pools per certificate authority |
1,000 |
3,000 |
Cross-resource RBAC role bindings to roles with Kafka permissions |
1,000 |
4,000 |
For the default limits and quota codes, see Service Quotas.
View and manage the add-on in Cloud Console
Organization administrators manage the add-on from the Upgrades and add-ons page in the Confluent Cloud Console.
Important
Only OrganizationAdmins can enable the add-on. Other users can access the included security capabilities after the add-on is enabled.
To enable the Advanced Security add-on:
Open the Cloud Console.
In the left navigation menu, click Admin & security.
Click Upgrades and add-ons.
Click the Advanced Security card.
In the dialog that opens, click Upgrade to enable the add-on.
Billing
The Advanced Security add-on is billed as a percentage uplift on your organization’s pre-support Confluent Cloud charges. Eligible charges include all Confluent Cloud usage across all products, such as Kafka, Connect, and Flink. The only exclusions are Support and Gateway add-on charges.
In the Confluent Cloud billing UI and on invoices, Advanced Security add-on charges appear as a distinct non-cluster-specific charge rather than as a per-cluster line item.
For pricing details, see Confluent Cloud pricing. For more information about Confluent Cloud billing, see Manage Billing.
Migration for existing users
If your organization was already using BYOK or higher IAM limits before the Advanced Security add-on was available, you can continue to use these features with these conditions:
If your organization already uses higher IAM limits, you keep those limits permanently.
If your organization already uses BYOK, you continue to have access to BYOK through March 15, 2027, or until the end of your commit term, whichever is greater. See your email for your applicable date.
After your applicable date, you need to enable the Advanced Security add-on or clear out your BYOK usage by deleting all resources with self-managed encryption and all your encryption keys.
For availability questions or interest in security capabilities, contact Confluent Support or your Confluent account team.