# Revoke Access to Data at Rest for Dedicated and Enterprise Kafka Clusters on Confluent Cloud Self-managed encryption keys used with Dedicated and Enterprise clusters on Confluent Cloud require access by Confluent to operate properly. You have full control over the encryption key and can revoke access to the key at any time. When you revoke access to the encryption key, Confluent has no access your data. #### WARNING Only revoke access if you have a major security concern and need to completely remove Confluent access to your data. When you disable, or revoke, access to the encryption key for a cluster, the cluster eventually stops. During this period, Confluent cannot guarantee SLA or data integrity. If you are using [Tableflow](../../../topics/tableflow/overview.md#cloud-tableflow) with Confluent Managed Storage, revoking access to the encryption key makes your Tableflow data inaccessible. ## Step 1: Delete your Confluent Cloud cluster 1. In your Confluent Cloud environment, stop all clients (producers and consumers) connected to your Confluent Cloud Kafka cluster. 2. If you are using [Tableflow](../../../topics/tableflow/overview.md#cloud-tableflow) with Confluent Managed Storage, note that disabling Tableflow-enabled topics before revoking access prevents data access but does not delete the stored Tableflow data. 3. Go the Confluent Cloud Console at [https://confluent.cloud/login](https://confluent.cloud/login) and [delete your cluster](../../../clusters/cluster-faq.md#delete-cloud-cluster). ## Step 2: Revoke access to the master key Follow the instructions for your cloud service provider to revoke access to the master key. ### AWS Go to the AWS KMS console at [console.aws.amazon.com/kms/home](https://console.aws.amazon.com/kms/home) and [disable access to the master key](https://docs.aws.amazon.com/kms/latest/developerguide/enabling-keys.html#enabling-keys-console). **Related content** - [Deleting AWS KMS keys](https://docs.aws.amazon.com/kms/latest/developerguide/deleting-keys.html) - [Enabling and disabling keys](https://docs.aws.amazon.com/kms/latest/developerguide/enabling-keys.html) ### Azure Go to Azure Key Vault in your Azure Portal at [https://portal.azure.com/](https://portal.azure.com/) and delete the service principal associated with the key. **Related content** - [Azure Key Vault](https://docs.microsoft.com/en-us/azure/key-vault/key-vault-overview) - [Azure encryption overview](https://docs.microsoft.com/en-us/azure/security/fundamentals/encryption-overview) - [Azure Data Encryption at Rest](https://docs.microsoft.com/en-us/azure/security/fundamentals/encryption-atrest) ### Google Cloud Go to the Key Management page in the Google Cloud console at [https://console.cloud.google.com/security/kms/](https://console.cloud.google.com/security/kms/) and [disable access to the master key](https://cloud.google.com/kms/docs/enable-disable#disable). **Related content** - [Default encryption at rest](https://cloud.google.com/docs/security/encryption/default-encryption) - [Enabling and disabling key versions](https://cloud.google.com/kms/docs/enable-disable) - [Destroying and restoring key versions](https://cloud.google.com/kms/docs/destroy-restore)