# Manage Service Accounts on Confluent Cloud This page provides detailed instructions for managing existing service accounts in Confluent Cloud, including granting access, deleting accounts, and using them for data operations. For information on creating service accounts, see [Create Service Accounts on Confluent Cloud](create-service-accounts.md#create-service-accounts). ## Required RBAC roles for managing service accounts The following RBAC roles can manage service accounts, including listing and describing (or view), updating (altering), grant and revoke access, and deleting service accounts: - [OrganizationAdmin](../../../access-control/rbac/predefined-rbac-roles.md#organizationadmin-role) - [AccountAdmin](../../../access-control/rbac/predefined-rbac-roles.md#accountadmin-role) The [ResourceOwner](../../../access-control/rbac/predefined-rbac-roles.md#resourceowner-role) role grants the following permissions to manage the existing service account to which the role is assigned: - Assign a service account to a Flink statement or a connector. - List, describe, or view a service account. - Update a service account. - Grant and revoke access permissions for a service account. - Delete a service account. - Create, describe, update, and delete the API keys that belong to a service account. The ResourceOwner role also grants the ability to *create* service accounts, no matter which resource the role is scoped to. A principal with ResourceOwner on any resource, such as a single topic, can create new service accounts in the organization. The principal can only grant those service accounts permissions on the resources in the role binding scope, unless the principal holds other roles that grant broader permissions. For details, see [ResourceOwner](../../../access-control/rbac/predefined-rbac-roles.md#resourceowner-role). ## List service accounts You can view a list of all service accounts in your organization using the Cloud Console, Confluent CLI, or Confluent Cloud APIs. ### Cloud Console 1. Go to the Confluent Cloud Console, expand the sidebar, and click **Accounts & access**. 2. Click **Service accounts**. The **Service accounts** page displays a list of all service accounts in your organization, including their names, descriptions, creation dates, and current status. ### Confluent CLI To list all service accounts using the Confluent CLI, use the following command: ```shell confluent iam service-account list ``` This command returns a list of all service accounts with their IDs, names, and descriptions. For details on the Confluent CLI command, see [confluent iam service-account list](https://docs.confluent.io/confluent-cli/current/command-reference/iam/service-account/confluent_iam_service-account_list.html). ### REST API To list service accounts using the REST API, use the following cURL command: ```shell curl --request GET \ --url 'https://api.confluent.cloud/iam/v2/service-accounts' \ --header 'Authorization: Basic REPLACE_BASIC_AUTH' ``` For details on listing service accounts using the REST API, see [List service accounts](https://docs.confluent.io/cloud/current/ccloud/list-iam-v-2-service-accounts/). ## View service account details You can view detailed information about a specific service account, including its permissions, API keys, and role assignments. ### Cloud Console 1. Go to the Confluent Cloud Console, expand the sidebar, and click **Accounts & access**. 2. Click **Service accounts**. 3. Click the service account name to access the service account details page. The service account details page displays comprehensive information including: - Service account name and description - Creation date and current status - Access permissions and role assignments - Associated API keys - Resource access history ### Confluent CLI To view details of a specific service account using the Confluent CLI, use the following command: ```shell confluent iam service-account describe ``` This command returns detailed information about the specified service account, including its name, description, and metadata. For details on the Confluent CLI command, see [confluent iam service-account describe](https://docs.confluent.io/confluent-cli/current/command-reference/iam/service-account/confluent_iam_service-account_describe.html). ### REST API To get details of a specific service account using the REST API, use the following cURL command: ```shell curl --request GET \ --url 'https://api.confluent.cloud/iam/v2/service-accounts/' \ --header 'Authorization: Basic REPLACE_BASIC_AUTH' ``` For details on retrieving service account information using the REST API, see [Get service account](https://docs.confluent.io/cloud/current/ccloud/get-iam-v-2-service-account/). ## Update service account details You can update certain properties of an existing service account, such as its description. Note that service account names cannot be changed after creation. ### Cloud Console 1. Go to the Confluent Cloud Console, expand the sidebar, and click **Accounts & access**. 2. Click **Service accounts**. 3. Click the service account name to access the service account details page. 4. Click **Edit** (pencil icon) next to the description field. 5. Update the description as needed. 6. Click **Save**. The service account description is updated and the changes are reflected immediately. ### Confluent CLI To update a service account using the Confluent CLI, use the following command: ```shell confluent iam service-account update \ --description "" ``` For example: ```shell confluent iam service-account update sa-1a2b3c \ --description "Updated description for analytics service account" ``` For details on the Confluent CLI command, see [confluent iam service-account update](https://docs.confluent.io/confluent-cli/current/command-reference/iam/service-account/confluent_iam_service-account_update.html). ### REST API To update a service account using the REST API, use the following cURL command: ```shell curl --request PATCH \ --url 'https://api.confluent.cloud/iam/v2/service-accounts/' \ --header 'Authorization: Basic REPLACE_BASIC_AUTH' \ --header 'Content-Type: application/json' \ --data '{ "description": "" }' ``` For example: ```shell curl --request PATCH \ --url 'https://api.confluent.cloud/iam/v2/service-accounts/sa-1a2b3c' \ --header 'Authorization: Basic REPLACE_BASIC_AUTH' \ --header 'Content-Type: application/json' \ --data '{ "description": "Updated description for analytics service account" }' ``` For details on updating service accounts using the REST API, see [Update service account](https://docs.confluent.io/cloud/current/ccloud/update-iam-v-2-service-account/). ## Grant access to a service account You can grant access to a service account for additional [principals](../../../../_glossary.md#term-principal) by assigning either the [Assigner](../../../access-control/rbac/predefined-rbac-roles.md#assigner-role) or the [ResourceOwner](../../../access-control/rbac/predefined-rbac-roles.md#resourceowner-role) role. ### Cloud Console 1. Go to the Confluent Cloud Console, expand the sidebar, and click **Accounts & access**. 2. Click **Service accounts**. 3. Click the service account name to access the service account details page. The service account details page appears. 4. Under **Access to this service account**, click **+ Add role assignment**. The **Role assignment on ** page appears. 5. Under **Account type**, select the account type to add to the service account and then select the account. 6. Under **Select role**, select the [Assigner](../../../access-control/rbac/predefined-rbac-roles.md#assigner-role) or the [ResourceOwner](../../../access-control/rbac/predefined-rbac-roles.md#resourceowner-role) role. Note that if you do not assign an account with ownership of the service account, the service account you cannot access the service account after you create it. 7. Click **Save**. The principal is assigned the role granting access to the service account. ### Confluent CLI To grant access to a service account using the Confluent CLI, you can assign role bindings with the following command: ```shell confluent iam rbac role-binding create \ --principal : \ --role \ --resource : ``` For example, to assign the Assigner role to a user for a specific service account: ```shell confluent iam rbac role-binding create \ --principal User: \ --role Assigner \ --resource ServiceAccount: ``` To assign ResourceOwner role to a service account: ```shell confluent iam rbac role-binding create \ --principal ServiceAccount: \ --role ResourceOwner \ --resource ServiceAccount: ``` For details on role binding commands, see [confluent iam rbac role-binding create](https://docs.confluent.io/confluent-cli/current/command-reference/iam/rbac/role-binding/confluent_iam_rbac_role-binding_create.html). ### REST API To grant access to a service account using the REST API, create a role binding using the following cURL command: ```shell curl --request POST \ --url 'https://api.confluent.cloud/iam/v2/role-bindings' \ --header 'Authorization: Basic REPLACE_BASIC_AUTH' \ --header 'Content-Type: application/json' \ --data '{ "principal": ":", "role_name": "", "crn_pattern": "crn://confluent.cloud/service-account=" }' ``` For example, to assign the Assigner role: ```shell curl --request POST \ --url 'https://api.confluent.cloud/iam/v2/role-bindings' \ --header 'Authorization: Basic REPLACE_BASIC_AUTH' \ --header 'Content-Type: application/json' \ --data '{ "principal": "User:", "role_name": "Assigner", "crn_pattern": "crn://confluent.cloud/service-account=" }' ``` For details on creating role bindings using the REST API, see [Create a role binding](https://docs.confluent.io/cloud/current/ccloud/create-iam-v-2-role-binding/). ## Delete a service account Follow the steps below to delete a service account. Before deleting a service account, make sure to: - Revoke any active API keys associated with the service account (see [Manage API Keys in Confluent Cloud](api-keys/manage-api-keys.md#manage-api-keys)) - Remove any role bindings (see [Manage RBAC role bindings on Confluent Cloud](../../../access-control/rbac/manage-role-bindings.md#manage-rbac-role-bindings)) - Update any applications using the service account’s API keys ### Cloud Console 1. Go to the Confluent Cloud Console, expand the sidebar, and click **Accounts & access**. 2. Click **Service accounts**. 3. Click the service account name to access the service account details page. The service account details page appears. 4. Click **Delete service account**. The **Delete service account** confirmation page appears. 5. Review the information and to confirm the deletion, enter the service account name under **Name** and then click **Confirm**. The service account is deleted. You can verify that the service account is deleted by reviewing the list of service accounts. ### Confluent CLI To delete a service account using the Confluent CLI, use the following command, replacing the service account ID with your own value: ```shell confluent iam service-account delete ``` For details on the Confluent CLI command, see [confluent iam service-account delete](https://docs.confluent.io/confluent-cli/current/command-reference/iam/service-account/confluent_iam_service-account_delete.html). ### REST API To delete a service account using the REST API, use the following cURL command, replacing the service account ID with your own value: ```shell curl --request DELETE \ --url 'https://api.confluent.cloud/iam/v2/service-accounts/' \ --header 'Authorization: Basic REPLACE_BASIC_AUTH' ``` For details on deleting a service account using the REST API, see [Delete a service account](https://docs.confluent.io/cloud/current/ccloud/delete-iam-v-2-service-account/). ### End-to-end example: Create and manage service accounts using the Confluent CLI The following example shows a typical end-to-end workflow that works for Confluent Cloud running on any cloud provider. Specifically, the example shows how to use the [Confluent CLI](https://docs.confluent.io/confluent-cli/current/overview.html) to: - Create a Kafka cluster and make it active - Add topics in the cluster - Set up a service account and ACLs - Create an API key resource-scoped to the Kafka cluster 1. Create a Confluent Cloud Kafka cluster (`sales092020`): ```shell confluent kafka cluster create sales092020 \ --cloud aws \ --region us-west-2 \ --type basic It may take up to 5 minutes for the Kafka cluster to be ready. +--------------+-----------------------------------------------------------+ | ID | lkc-abc123 | | Name | sales092020 | | Type | BASIC | | Ingress | 100 | | Egress | 100 | | Storage | 5000 | | Cloud | aws | | Availability | single-zone | | Region | us-west-2 | | Status | UP | | Endpoint | SASL_SSL://pkc-v8wpn.us-west-2.aws.confluent.cloud:9092 | | ApiEndpoint | https://pkac-95yx5.us-west-2.aws.confluent.cloud | +--------------+-----------------------------------------------------------+ ``` #### NOTE Make note of your cluster ID. You will need to specify it in subsequent steps. If at any time you are unsure of the ID, run the `confluent kafka cluster list` command to view all your Kafka clusters and corresponding cluster IDs. 2. Make the newly-created Kafka cluster the active cluster: ```shell confluent kafka cluster use lkc-abc123 Set Kafka cluster "lkc-abc123" as the active cluster for environment "env-123abc" ``` 3. Create topics (`raw_pageview_data` and `analytics_enriched_events`) in the Kafka cluster: ```shell confluent kafka topic create raw_pageview_data confluent kafka topic create analytics_enriched_events ``` 4. Create a service account named `analytics`. You must include a description: ```shell confluent iam service-account create analytics \ --description "My API analytics and secrets service account" +-------------+---------------------------------------+ | ID | sa-1a2b3c | | Name | analytics | | Description | My API analytics and secrets service | | | account. | +-------------+---------------------------------------+ ``` If you ever lose track of the service account ID, run `confluent iam service-account list` to retrieve it. 5. Create a READ ACL for the topic `raw_pageview_data`. ```shell confluent kafka acl create --allow \ --service-account sa-1a2b3c \ --operations read \ --topic raw_pageview_data Principal | Permission | Operation | ResourceType | ResourceName | PatternType +------------------+------------+-----------+--------------+-------------------+------------+ User:sa-1a2b3c | ALLOW | READ | TOPIC | raw_pageview_data | LITERAL ``` Optionally, you can create ACLs using the `--prefix` option, which Kafka uses to match all resource names that are prefixed with the specified value. This example shows how to create a READ ACL that applies for all consumer groups that use the prefix `keyreaders`: ```shell confluent kafka acl create --allow \ --service-account sa-1a2b3c \ --operations read \ --prefix \ --consumer-group keyreaders Principal | Permission | Operation | ResourceType | ResourceName | PatternType +------------------+------------+-----------+--------------+-------------------+------------+ User:sa-1a2b3c | ALLOW | READ | GROUP | keyreaders | PREFIXED ``` 6. Create ACLs for all topics that use a specific prefix. This example shows how to specify a CREATE ACL for topics with the prefix `analytics_`. Running this command creates ACLs that provide CREATE and WRITE access to any topic whose name starts with `analytics_`: ```shell confluent kafka acl create --allow \ --service-account sa-1a2b3c \ --operations create \ --prefix \ --topic analytics_ Principal | Permission | Operation | ResourceType | ResourceName | PatternType +------------------+------------+-----------+--------------+-------------------+------------+ User:sa-1a2b3c | ALLOW | CREATE | TOPIC | analytics_ | PREFIXED ``` 7. Create a WRITE ACL to a `analytics_enriched_events` topic with a prefix: ```shell confluent kafka acl create --allow \ --service-account sa-1a2b3c \ --operations write \ --prefix \ --topic analytics_ Principal | Permission | Operation | ResourceType | ResourceName | PatternType +------------------+------------+-----------+--------------+-------------------+------------+ User:sa-1a2b3c | ALLOW | WRITE | TOPIC | analytics_ | PREFIXED ``` 8. Create an API key resource-scoped to the Kafka cluster for service account `sa-1a2b3c`. Be sure to replace the service account ID and Kafka cluster ID values shown here with your own: ```shell confluent api-key create \ --service-account sa-1a2b3c \ --resource lkc-abc123 It may take a couple of minutes for the API key to be ready. Save the API key and API secret. The API secret is not retrievable later. +-------------+------------------------------------------------------------------+ | API Key | 12A3BCDEFGHI4JKL | | API Secret | aB+c12dEfghiJkLMNopqr3StUVWxyzabCdEFGHiJ4kL5mnop6QrS78TUVwxyzaB9 | +-------------+------------------------------------------------------------------+ ``` #### WARNING **Save the API key and API secret.** You require this information to configure your client applications. Be aware that this is the *only* time you can access and view the key and secret. Optionally, if you are using the [Confluent Cloud Metrics](../../../../monitoring/metrics-api.md#metrics-api) or [Health+](/platform/current/monitor/proactive-support.html) and you require a [Confluent Cloud API key](api-keys/manage-api-keys.md#cloud-cloud-api-keys): ```shell confluent api-key create \ --service-account sa-1a2b3c \ --resource cloud It may take a couple of minutes for the API key to be ready. Save the API key and secret. The secret is not retrievable later. +-------------+------------------------------------------------------------------+ | API Key | AB1CDEF2GHI3J4KL | | API Secret | j3Am6e+loCkCJUQ43iq9Es1z5KO7kKZQGmBvjg7jombv1PR0kxCvjsh6IDrz9LHY | +-------------+------------------------------------------------------------------+ ``` Note that ACLs are not supported against Confluent Cloud API keys. #### IMPORTANT Client applications that connect to the Confluent Cloud cluster must have at least the following three parameters configured: - API key – available when you initially create the API key pair - API secret – available when you initially create the API key pair - `bootstrap.servers` – set to the `Endpoint` in the output of `confluent kafka cluster describe` For details about Confluent CLI service account commands, see [Confluent CLI](https://docs.confluent.io/confluent-cli/current/overview.html). ## Use Confluent Cloud service accounts to produce and consume After creating a service account and configuring the necessary ACLs and API keys, you can use it to control application access to produce and consume messages from Confluent Cloud topics using the Cloud Console, Confluent CLI, or Confluent Cloud APIs. ### Produce messages ### Cloud Console 1. Go to the Confluent Cloud Console, and navigate to your cluster. 2. In the left navigation, click **Topics**. 3. Click the topic you want to produce to. 4. Click the **Messages** tab. 5. Click **+ Produce a new message to this topic**. 6. In the authentication section, select **Use existing API key**. 7. Enter the API key and secret for your service account. 8. Enter your message key and value. 9. Click **Produce**. The service account must have the appropriate ACLs configured for WRITE operations on the topic. ### Confluent CLI To produce messages using the Confluent CLI with a service account: 1. Set the API key for your service account: ```shell confluent api-key use --resource ``` 2. Produce messages to a topic: ```shell # Produce to topic confluent kafka topic produce ``` You can also produce from a file: ```shell confluent kafka topic produce < messages.txt ``` The service account must have the appropriate ACLs configured for WRITE operations on the topic. ### REST API To produce messages using the Confluent Cloud REST API with a service account, use the service account’s API key for authentication: ```shell curl -X POST \ -H "Content-Type: application/vnd.kafka.json.v2+json" \ -H "Authorization: Basic " \ -d '{ "records": [ { "key": "sample-key", "value": "sample-value" } ] }' \ "https:///kafka/v3/clusters//topics//records" ``` The service account must have the appropriate ACLs configured for WRITE operations on the topic. For detailed REST API documentation, see the [Kafka REST API Reference](https://docs.confluent.io/cloud/current/ccloud/topic-v-3/). ### Consume messages ### Cloud Console 1. Go to the Confluent Cloud Console, and navigate to your cluster. 2. In the left navigation, click **Topics**. 3. Click the topic you want to consume from. 4. Click the **Messages** tab. 5. In the authentication section, select **Use existing API key**. 6. Enter the API key and secret for your service account. 7. Configure your consumption settings (offset, partition, etc.). 8. Click **Consume** to start consuming messages. The service account must have the appropriate ACLs configured for READ operations on the topic. ### Confluent CLI To consume messages using the Confluent CLI with a service account: 1. Set the API key for your service account: ```shell confluent api-key use --resource ``` 2. Consume messages from a topic: ```shell # Consume from topic (-b consumes from beginning of topic) confluent kafka topic consume -b ``` You can also consume and output to a file: ```shell confluent kafka topic consume -b > consumed-messages.txt ``` The service account must have the appropriate ACLs configured for READ operations on the topic. ### REST API To consume messages using the Confluent Cloud REST API with a service account, use the service account’s API key for authentication. First, create a consumer: ```shell curl -X POST \ -H "Content-Type: application/vnd.kafka.json.v2+json" \ -H "Authorization: Basic " \ -d '{ "name": "my-consumer", "format": "json", "auto.offset.reset": "earliest" }' \ "https:///kafka/v3/clusters//topics//consumers" ``` Then consume messages: ```shell curl -X GET \ -H "Accept: application/vnd.kafka.json.v2+json" \ -H "Authorization: Basic " \ "https:///kafka/v3/clusters//topics//consumers//records" ``` The service account must have the appropriate ACLs configured for READ operations on the topic. For detailed REST API documentation, see the [Kafka REST API Reference](https://docs.confluent.io/cloud/current/ccloud/topic-v-3/). ## Related content - [Create Service Accounts](create-service-accounts.md#create-service-accounts) - [Service Account Overview](../manage-workload-identities.md#manage-workload-identities) - [Manage API Keys](api-keys/manage-api-keys.md#manage-api-keys) - [Manage Role Bindings](../../../access-control/rbac/manage-role-bindings.md#manage-rbac-role-bindings) - [Predefined RBAC Roles](../../../access-control/rbac/predefined-rbac-roles.md#predefined-rbac-roles) - [Service Quotas](../../../../quotas/service-quotas.md#service-quotas) - [confluent iam service-account [Confluent CLI Reference]](https://docs.confluent.io/confluent-cli/current/command-reference/iam/service-account/confluent_iam_service-account.html) - [Service Accounts (iam/v2) [Confluent Cloud API Reference]](https://docs.confluent.io/cloud/current/ccloud/service-accounts-iam-v-2/)