<a id="service-accounts"></a>

<a id="service-accounts-overview"></a>

# Service Accounts on Confluent Cloud

Each service account represents an application programmatically accessing Confluent Cloud.

You can manage application access to Confluent Cloud by using service accounts.
Permissions can be specified using [ACLs](../../../access-control/acls/overview.md#acl-manage) and
[role bindings](../../../access-control/rbac/overview.md#cloud-rbac) tied to a specific service account. ACLs and
role bindings for service accounts are set by an administrator or
another user with a similar role within the organization.

Service accounts are an [organization-level](../../../access-control/hierarchy/cloud-environments.md#cloud-environments) resource,
and there is a [limit on the number of service accounts in an organization](../../../../quotas/service-quotas.md#service-quotas-service-accounts).

Service accounts span the entire organization and can own API keys for many
different resources, including development and production clusters. A typical use
case has one team administering the Confluent Cloud streaming platform and issuing
service accounts (with ACLs applied) to various application teams that
use the streaming platform. While service accounts cannot sign in to the Confluent Cloud Console,
they can own any type of [API keys](api-keys/overview.md#cloud-api-keys) that can be used for
CLI or API access. Keep in mind the following:

- Although users can leave or change roles within a company, applications continue
  to operate independently of the users, service accounts are especially useful
  in organizations requiring special identifiers for applications or services
  not be tied to a specific user.
- The number of API keys that can belong to a specific service account is
  limited. For details, see [Service Quotas for Confluent Cloud](../../../../quotas/service-quotas.md#ccloud-resource-limits).
- You can create service accounts using any of the following methods:
  - [Confluent Cloud Console](create-service-accounts.md#create-service-accounts). When creating
    service accounts using the Confluent Cloud Console, you can create Kafka and Confluent Cloud
    API keys and make the owner a service account. The Cloud Console
    cannot create Schema Registry or ksqlDB API keys owned by a service account.
  - Confluent CLI command [confluent iam service-account create](https://docs.confluent.io/confluent-cli/current/command-reference/iam/service-account/confluent_iam_service-account_create.html).
    When you create a service account using [Confluent CLI](https://docs.confluent.io/confluent-cli/current/command-reference/iam/service-account/confluent_iam_service-account_create.html),
    you can optionally create any type of [API key](api-keys/overview.md#cloud-api-keys) and
    make the owner a service account.
  - [Confluent Cloud API](../../../../api.md#cloud-apis)
  - [Confluent Terraform Provider](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_service_account)
- Kafka ACLs only apply to Kafka clusters and are not supported for other resource
  types. Hence, ACLs that exist for a service account are not inherited when you
  create a Schema Registry API key from that service account.

| API key type    | Managed in Confluent Cloud Console?   | Managed in Confluent CLI?   | Managed in Confluent Terraform Provider?   |
|-----------------|---------------------------------------|-----------------------------|--------------------------------------------|
| Kafka           | Yes                                   | Yes                         | Yes                                        |
| Schema Registry | Yes                                   | Yes                         | Yes                                        |
| ksqlDB          | No                                    | Yes                         | Yes                                        |
| Flink           | No                                    | Yes                         | Yes                                        |
| Confluent Cloud | Yes                                   | Yes                         | Yes                                        |

## Related content

- [Manage Service Accounts on Confluent Cloud](manage-service-accounts.md#manage-service-accounts)