# Enable Private Networking on Confluent Cloud for Schema Registry Confluent Cloud Schema Registry supports private networking on Amazon Web Services, Azure, and Google Cloud. This feature enables your client applications in the virtual private cloud (VPC) to securely access Schema Registry without egressing to the public internet from your VPC. ## How does it work? Schema Registry has public access by default. You have the following options for using private networking with Confluent Cloud for Schema Registry. ### Confluent Cloud network (CCN) on AWS and Azure If you have a [Confluent Cloud network](../../networking/overview.md#cloud-networking) configured for Dedicated Kafka clusters, this is a quick-and-easy starting point for setting up private networking on AWS or Azure. With a CCN already configured, and at least one Kafka Dedicated cluster in the environment and region, a corresponding private endpoint for the Schema Registry is automatically provided in the same region. You can view this on the Confluent Cloud Console at **Environment** > **Schema Registry** > **Endpoints**. For existing Kafka Dedicated users, the setup is seamless when everything is already configured for Kafka. To create a CCN, follow the steps in [Create Confluent Cloud Network on AWS](../../networking/ccloud-network/aws.md#create-ccloud-network-aws). ### Private network connectivity on AWS, Azure, and Google Cloud Private network endpoints are resources that enable you to connect to Confluent serverless products, like Enterprise clusters and Apache Flink®. You can get a private endpoint by creating one in every region where you have a Apache Kafka® cluster deployed. For example, if you have a Kafka cluster deployed in region A, you can create a private endpoint in region A and get a region A specific private endpoint for Schema Registry, making it accessible in region A’s VPC. In this way, you can have multiple VPCs deployed across different regions accessing the Kafka clusters within the environment, through these regional private endpoints for Schema Registry. Each private endpoint is used to establish a connection between your client applications (including Cloud Console, Confluent CLI, Terraform) and Schema Registry, enabling your clients to access Schema Registry from your VPCs. ### Private Network Interface (PNI) on AWS On AWS, if you use Private Network Interface (PNI) to connect to Enterprise or Freight clusters, you can reach Schema Registry over the same PNI connection. You don’t need a separate AWS PrivateLink connection for Schema Registry. When a PNI gateway and access point exist in an environment, Confluent Cloud creates a PNI endpoint for Schema Registry in that environment automatically. You can view it on the Confluent Cloud Console at **Environment** > **Schema Registry** > **Endpoints**. To set up a PNI gateway and access point, follow the steps in [Use Private Network Interface on Confluent Cloud](../../networking/aws-pni.md#pni-overview-aws). For the endpoint format and connection details, see [Access Schema Registry over PNI](../../networking/aws-pni.md#pni-schema-registry-aws). ### IP filtering to secure Schema Registry connectivity on public networks You can restrict the public endpoint using IP filtering, so that only a limited set of IPs are able to access Schema Registry via the public endpoint. ## Enable private networking for Schema Registry ### Prerequisites - You can use Terraform version 2.23.0 or later; but recommended is v2.32.0 or later. - You must use Confluent CLI version v4.29.0 or later. - Access to Confluent Cloud. - A Confluent Cloud environment with at least the Stream Governance Essentials package enabled. - The [OrganizationAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#organizationadmin-role), [EnvironmentAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#environmentadmin-role), or [NetworkAdmin](../../security/access-control/rbac/predefined-rbac-roles.md#networkadmin-role) role to create a private endpoint. - The Confluent Cloud network (CCN) or private endpoint, Kafka cluster, and Schema Registry cluster should be configured in any of the supported regions. - A VPC in AWS or Google Cloud, or VNet in Azure. ### Overview The high level steps are: 1. [Step 1: Use a Confluent Cloud network, private network endpoint, or PNI connection](#sr-config-ccn-or-pla). 2. [(Optional) Step 2: Restrict public access to Schema Registry with IP filtering](#sr-private-networking-ip-filters). 3. [(Optional) Step 3: Connect to the network with Confluent Cloud Console](#sr-private-networking-connect-to-network). #### Step 1: Use a Confluent Cloud network, private network endpoint, or PNI connection You can enable private networking to Schema Registry with a Confluent Cloud network, a private network endpoint, or an existing PNI connection on AWS. ##### Configure a Confluent Cloud network (an option for AWS or Azure) Follow the steps in the networking documentation to [Create Confluent Cloud Network on AWS](../../networking/ccloud-network/aws.md#create-ccloud-network-aws) or [Create Confluent Cloud Network on Azure](../../networking/ccloud-network/azure.md#create-ccloud-network-azure). If you already have a CCN setup in a supported region, you automatically get a private endpoint to connect to the Schema Registry in the virtual private cloud (VPC) where the network is set up. To check if you already have a CCN setup, go to **Environments** > **Network Management** > **For Dedicated clusters**. This page lists all the CCNs set up in your environment.  If they are set up in a supported region, you will get corresponding private endpoints for Schema Registry. You can view them in **Environment** > **Schema Registry** > **Endpoints**.  The private endpoints based on CCN network can be obtained by replacing the `` in the endpoint suffix for the private network: - For a private endpoint, use the endpoint suffix for the network: `..region.cloud.confluent.cloud`. Obtain the corresponding private endpoint by replacing the `` with the LSRC ID. For example, `lsrc-xxxx..region.cloud.confluent.cloud`. - For VPC Peering and Transit Gateway, use the endpoint suffix for the network: `-.region.cloud.confluent.cloud`. Obtain the corresponding private endpoint by replacing the `` with the LSRC ID. For example, `lsrc-xxxx-.region.cloud.confluent.cloud`. Each supported region’s CCN will have a unique private endpoint for the Schema Registry. Use the CCN’s endpoint in its associated VPC. ##### Configure private endpoint and network connectivity The following steps guide you through setup of Schema Registry private networking primarily using the Cloud Console. You can also set up private endpoints to Schema Registry with the Confluent CLI or Terraform. Information about using those tools and other tools is provided at the end of this Quick Start. Follow these steps to create a private endpoint, a network connection on Confluent Cloud, and set up a DNS resolution. 1. In Confluent Cloud, create a network connection point in [AWS](../../networking/aws-platt.md#privatelinkattachment-create), [Azure](../../networking/azure-platt.md#privatelinkattachment-create-az), or [Google Cloud](../../networking/gcp-platt.md#privatelinkattachment-create-gc). 2. Create either a VPC endpoint (AWS), or private endpoint (Azure or Google Cloud) as follows: - In AWS, [Step 2: Create an AWS VPC endpoint](../../networking/aws-platt.md#privatelinkattachment-endpoint-create) - In Azure, [Step 2: Create an Azure private endpoint](../../networking/azure-platt.md#privatelinkattachment-endpoint-create-az) - In Google Cloud, [Use Google Cloud Private Service Connect for Serverless Products on Confluent Cloud](../../networking/gcp-platt.md#cloud-networking-privatelink-gc-esku) 3. In Confluent Cloud, create a private network connection in [AWS](../../networking/aws-platt.md#privatelinkattachment-connection-create), [Azure](../../networking/azure-platt.md#privatelinkattachment-connection-create-az), or [Google Cloud](../../networking/gcp-platt.md#privatelinkattachment-create-gc). 4. Set up a DNS resolution in [AWS](../../networking/aws-platt.md#privatelinkattachment-dns), [Azure](../../networking/azure-platt.md#privatelinkattachment-dns-az), or [Google Cloud](../../networking/gcp-platt.md#private-service-connect-gc-dns-records-esku). When you have successfully created the endpoint and connectivity in Confluent Cloud, you should see this reflected in Schema Registry on the Cloud Console as shown:  At this point, Schema Registry is ready for use on the private network. ##### Use an existing PNI connection on AWS On AWS, if you use PNI to connect to Enterprise or Freight clusters, you can reach Schema Registry in that environment over the same PNI connection. No separate Schema Registry setup is required. Confirm that a PNI gateway and access point exist in the environment, or create them by following the steps in [Use Private Network Interface on Confluent Cloud](../../networking/aws-pni.md#pni-overview-aws). Confluent Cloud then creates a PNI endpoint for Schema Registry automatically, in the following format: ```text lsrc--..aws.accesspoint.glb.confluent.cloud ``` To find the endpoint, go to **Environment** > **Schema Registry** > **Endpoints** on the Confluent Cloud Console, or read it from the `confluent_endpoint` Terraform data source. For more information, see [Access Schema Registry over PNI](../../networking/aws-pni.md#pni-schema-registry-aws). #### (Optional) Step 2: Restrict public access to Schema Registry with IP filtering You can use [IP filters](../../security/access-control/ip-filtering/overview.md#ip-filtering-overview) to restrict the public access to Schema Registry to specified IP address ranges. 1. Create [IP groups](../../security/access-control/ip-filtering/manage-ip-groups.md#create-ip-group). 2. Create [IP filters](../../security/access-control/ip-filtering/manage-ip-filters.md#create-ip-filter). 3. Apply to schema management. View IP filters applied to the Schema Registry by going to **Network Management** > **Public Networks** on the Cloud Console. If you want to disable all public access to Schema Registry, create an IP filter using the [No Public Networks](../../security/access-control/ip-filtering/manage-ip-groups.md#no-public-networks-group) IP group. If you do this [Step 3](#sr-private-networking-connect-to-network) becomes mandatory to access schemas on the Cloud Console. Note that internal clients such as fully managed connectors, Flink SQL statements, Tableflow, and ksqlDB will continue to access Schema Registry through public internet. Traffic on internal Confluent components is uniquely identified, and not affected by IP filtering. #### (Optional) Step 3: Connect to the network with Confluent Cloud Console You can access the Cloud Console from anywhere if you have enabled the public endpoint access for Schema Registry. If you have restricted access to it using IP filtering, you need to connect to Cloud Console using a valid IP over public internet or on the appropriate VPC where you have provisioned the private endpoint. Users will see the following error if they attempt to access schemas from an unauthorized IP address or from a VPC network that does not have access to the private endpoint you created.  To connect to Confluent Cloud with the private endpoint, see [Use Confluent Cloud with Private Networking](../../networking/ccloud-console-access.md#ccloud-console-access-networking). The [Resource Metadata access option](../../networking/ccloud-console-access.md#ccloud-console-with-resource-management-access) is not currently supported for Schema Registry. One way to connect is to set up a [reverse proxy](../../networking/ccloud-console-access.md#proxied-access). To learn more, see [Configure a proxy](../../networking/ccloud-console-access.md#proxied-access). When networking is set up in Cloud Console, select the **private** endpoint in the drop-down menu.  Your schemas should now be viewable on the Schema Registry page.  ## Migrate clients from the public endpoint to private endpoint for Schema Registry If you are using the public endpoint for Schema Registry but want to migrate clients to use the private endpoint, you can do so as follows: 1. Identify the principal IDs sending traffic by means of the public endpoint to Schema Registry. The `traffic_type` metric recently added to `schema_operations_count` has values PUBLIC and PRIVATE which allow you to identify public and private traffic to Schema Registry. You can use `principal_id` with this metric to see which principal IDs are sending which kinds of traffic, as shown in the example below. Create a file named `sr_traffic.json` using the following template. Be sure to change `lsrc-XXXXX` and the timestamp values to match your needs. ```properties { "aggregations": [ { "metric": "io.confluent.kafka.schema_registry/schema_operations_count" } ], "filter": { "field": "resource.schema_registry.id", "op": "EQ", "value": "lsrc-XXXXX" "internal_request": "false" }, "granularity": "PT1M", "intervals": [ "2021-02-24T10:00:00Z/2021-02-24T10:01:00Z" ], "group_by": [ "resource.schema_registry.id", "metric.principal_id", "metric.traffic_type" ] } ``` 2. Submit the query as a POST using the following command. Be sure to change `` and `` to match your environments. ```bash http 'https://api.telemetry.confluent.cloud/v2/metrics/cloud/query' --auth ':' < sr_traffic.json ``` Your output should resemble: ```bash { "data": [ { "resource.schema_registry.id": "lsrc-XXXXX", "metric.principal_id": "sa-abc123", "traffic_type": "PUBLIC" , "timestamp": "2021-02-24T10:00:00Z", "value": 1.0 } ] } ``` To learn more about monitoring and metrics for Confluent Cloud, see [Confluent Cloud Metrics](../../monitoring/metrics-api.md#metrics-api). To learn more about Schema Registry metrics definitions, refer to **Resource:** `schema_registry` section in the [Confluent Cloud Metrics API Reference](https://api.telemetry.confluent.cloud/docs/descriptors/datasets/cloud). ## Use Schema Linking with private endpoints You can use the private endpoints for a Schema Registry when creating schema exporters on Confluent Platform or Confluent Cloud Schema Registry. You need to provide the private endpoint and the corresponding API key information when creating the exporter. You can use this Confluent CLI command to retrieve the endpoint: [confluent schema-registry cluster describe](https://docs.confluent.io/confluent-cli/current/command-reference/schema-registry/cluster/confluent_schema-registry_cluster_describe.html). You can’t use CCN based endpoints or PNI endpoints for Schema Linking between two Confluent Cloud Schema Registry clusters. To use a private endpoint for Schema Linking between two Confluent Cloud Schema Registry clusters, use the following endpoint format: ```bash https://...private.confluent.cloud ``` This does not require a private endpoint configuration. Schema Linking between Confluent Cloud Schema Registry clusters supports only the `.private.confluent.cloud` endpoint format, not multi-PrivateLink Attachment (Multi-PLATT) endpoints, which use the `accesspoint.glb.confluent.cloud` suffix. To learn more about Schema Linking, see [Schema Linking on Confluent Cloud](../schema-linking.md#schema-linking). ## Use Confluent CLI with private endpoints to talk to Schema Registry Once you have [set up private networking for Schema Registry](#enable-sr-private-network-procedure), you can use the Confluent CLI version v4.29.0 or later with private endpoints for Schema Registry, as follows: 1. Get a list of private endpoints. ```bash confluent schema-registry endpoint list ``` Your output should resemble: ```bash +--------------------------------+-------------------------------------------------------------------+ | Public Endpoint URL | https://psrc-xxxx.us-west-2.aws.confluent.cloud | | Private Endpoint URL | https://lsrc-xxxx.us-west-2.aws.private.confluent.cloud | | Private Regional Endpoint URLs | n-nxxxx=https://lsrc-xxxx.domabc.us-west-2.aws.confluent.cloud | | | n-nxxxx=https://lsrc-xxxx-nxyx.us-west-2.aws.confluent.cloud | | | n-nxxxx=https://lsrc-xxxx-ndef.us-west-2.aws.glb.confluent.cloud | | | us-west-2=https://lsrc-xxxx.us-west-2.aws.private.confluent.cloud | | Catalog Endpoint URL | https://psrc-xxxx.us-west-2.aws.confluent.cloud | +--------------------------------+-------------------------------------------------------------------+ ``` In the list: - The Private Endpoint URL was created when you set up private networking (`https://lsrc-xxxx.us-west-2.aws.private.confluent.cloud`). - The endpoints mapped to the network ID, which start with `n-`, are the Confluent Cloud network endpoints. For example: ```bash n-nxxxx=https://lsrc-xxxx.domabc.us-west-2.aws.confluent.cloud ``` - The endpoints mapped to the region are private network endpoints. For example: ```bash us-west-2=https://lsrc-xxxx.us-west-2.aws.private.confluent.cloud ``` 2. To use a specific private endpoint, use the `--schema-registry-endpoint` flag with any Confluent CLI command. For example: ```bash confluent sr configuration describe --schema-registry-endpoint https://lsrc-xxxx.domabc.us-west-2.aws.confluent.cloud ``` ```bash confluent sr configuration describe --schema-registry-endpoint https://lsrc-xxxx-nxyz.us-west-2.aws.confluent.cloud ``` ```bash confluent sr configuration describe --schema-registry-endpoint https://lsrc-xxxx.us-west-2.aws.private.confluent.cloud ``` In all cases, your output should resemble the following (providing the compatibility level configured for the Schema Registry on the given network): ```bash +---------------------+----------+ | Compatibility Level | BACKWARD | +---------------------+----------+ ``` ## Use Terraform with private endpoints to talk to Schema Registry Once you have [set up private networking for Schema Registry](#enable-sr-private-network-procedure), you can use Terraform version v2.32.0 or later with private endpoints for Schema Registry. Use [confluent_private_link_access](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_private_link_access) Confluent Terraform Provider resource to create a private endpoint and Confluent Cloud private network connectivity. For example, to create a Schema Registry encryption key, you would feed this into the `rest_endpoint` attribute: ```bash resource "confluent_schema_registry_kek" "aws_key" { schema_registry_cluster { id = data.confluent_schema_registry_cluster.essentials.id } rest_endpoint = "https://${data.confluent_schema_registry_cluster.essentials.id}${data.confluent_network.main.endpoint_suffix}" credentials { key = "" secret = "" } name = "my_key" kms_type = "aws-kms" kms_key_id = "key_id" doc = "test key" shared = false hard_delete = true lifecycle { prevent_destroy = true } } ``` ## Stream Catalog endpoints The Stream Catalog endpoint and APIs will remain accessible only via public internet. To learn more, see: [Stream Catalog REST API Usage and Examples on Confluent Cloud](../../stream-governance/stream-catalog-rest-apis.md#stream-catalog-rest-apis), and especially, [Setup and suggestions](../../stream-governance/stream-catalog-rest-apis.md#catalog-api-usage-setup). ## Limitations - Schema Registry with private networking is currently available only in select regions on [AWS](#sr-private-link-aws-regions), [Azure](#sr-private-link-azure-regions), and [Google Cloud](#sr-private-link-google-cloud-regions). - [Resource Metadata access](../../networking/ccloud-console-access.md#ccloud-console-with-resource-management-access) is not applicable for Schema Registry. - Custom connectors cannot use Schema Registry configured with private access. - CCN Networks for Google Cloud are not supported. - PNI connectivity for Schema Registry is available on AWS only. - Schema Linking does not support PNI endpoints. To use Schema Linking with a private endpoint, see [Use Schema Linking with private endpoints](#schema-linking-private-endpoints). ## Supported regions For the full list of regions where Schema Registry private networking is supported, see [Private network support](../../get-started/regions.md#regions-private-network-support) in the regions overview. PNI connectivity for Schema Registry is available only in the supported AWS regions where Schema Registry private networking is enabled. ## FAQ ### FAQ Quick List - [Is there an extra charge for using this feature?](#faq-pl-cost) - [I already have a Dedicated cluster and corresponding private network setup, is a dedicated private network connection still necessary?](#faq-dedicated-cluster-enabled) - [Is the private connection created for Flink or Enterprise cluster private networking re-used for Schema Registry?](#faq-reuse-of-private-links) - [Can I use PNI to access Schema Registry on AWS?](#faq-pni-and-sr) - [Is it possible to block all public traffic to the Schema Registry using IP filtering?](#faq-ip-filters-to-block-all-traffic) - [Does IP filtering affect my private traffic, public traffic, or both?](#faq-ip-filters-and-public-traffic) - [Does IP filtering for schema management impact existing connectors, Flink statements, linked schema registries, or ksqlDB setups that access schema registries?](#faq-ip-filters-and-other-components-accessing-sr) - [Is IP filtering also applicable for Stream Governance catalog, as it shares the same public endpoint as Schema Registry?](#faq-ip-filters-and-stream-catalog) - [Is the private endpoint applicable for Stream Catalog access?](#faq-private-link-and-stream-catalog) - [Is it possible to use Schema Linking with private endpoints?](#faq-private-link-and-schema-linking) - [There are multiple endpoints for Schema Registry, does this mean a different Schema Registry exists in every region?](#faq-multiple-endpoints-and-regions) - [There are multiple endpoints for Schema Registry in different regions, does this mean there is schema redundancy in the these regions?](#faq-multiple-endpoints-and-schema-redundancies) - [Why is a “Create Cluster” message shown on the UI when I try to enable Stream Governance, if I already have Kafka clusters present in the environment?](#faq-upgrade-cli-and-terraform) ### Q&As Is there an extra charge for using this feature? : This feature is available starting with the Stream Governance **Essentials** package which is free till 100 schemas. There is no extra charge for this feature. (See, [Manage Stream Governance Packages in Confluent Cloud](../../stream-governance/packages.md#stream-gov-packages) to learn more about Stream Governance packages.) I already have a Dedicated cluster and corresponding private network setup, is a new private endpoint still necessary? : This depends on which cloud provider you use.
- On AWS or Azure, no, you do not need to perform further private endpoint and connectivity setup, as you will automatically get a private endpoint based on the private network setup for the Dedicated cluster. - On Google Cloud, Confluent Cloud network for private networking is not supported. This means that with an existing Dedicated cluster and associated private network, you have to set up a specific private endpoint for Schema Registry. Is the private endpoint created for Flink or Enterprise cluster private networking re-used for Schema Registry? : Yes, a private endpoint created in a region will be re-used automatically. Can I use PNI to access Schema Registry on AWS? : Yes. On AWS, if you use PNI to connect to Enterprise or Freight clusters, you can reach Schema Registry over the same PNI connection, with no separate AWS PrivateLink setup. For more information, see [Access Schema Registry over PNI](../../networking/aws-pni.md#pni-schema-registry-aws). Is it possible to block all public traffic to the Schema Registry using IP filtering? : Using the [No Public Networks](../../security/access-control/ip-filtering/manage-ip-groups.md#no-public-networks-group) IP group will block all public traffic to the Schema Registry. With this configuration, Cloud Console would not display [schemas](data-contracts.md#sr-data-contracts) over the public internet. To regain access to the schemas UI, create a proxy with access to the VPC where the private Schema Registry endpoint is accessible, as described in [Step 3](#sr-private-networking-connect-to-network). Does IP filtering affect my private traffic, public traffic, or both? : [IP filtering](../../security/access-control/ip-filtering/overview.md#ip-filtering) is only applied to public traffic. Does IP filtering for schema management impact existing connectors, Flink statements, linked schema registries, or ksqlDB setups that access Schema Registry? : No, IP filtering is only applied to public traffic originating outside Confluent Cloud. Is IP filtering also applicable for Stream Catalog, as it shares the same public endpoint as Schema Registry? : No, IP filtering is only applicable for Schema Registry APIs. Is the private endpoint applicable for Stream Catalog access? : No, private endpoints only provide private access to Schema Registry.
(To learn more about Stream Catalog and using its APIs, see [Stream Catalog on Confluent Cloud: User Guide to Manage Tags and Metadata](../../stream-governance/stream-catalog.md#cloud-stream-catalog) and [Stream Catalog REST API Usage and Examples on Confluent Cloud](../../stream-governance/stream-catalog-rest-apis.md#stream-catalog-rest-apis).) Is it possible to use Schema Linking with private endpoints? : Yes, you can create a [schema exporter](../schema-linking.md#schema-exporters) using a private endpoint with source and destination Schema Registry in the same or different region. There are multiple endpoints for Schema Registry, does this mean a different Schema Registry exists in every region? : No, all the endpoints provide access to one Schema Registry in the environment. There are multiple endpoints for Schema Registry in different regions, does this mean there is schema redundancy in the these regions? : No, all the endpoints provide access to one Schema Registry in the environment. If the region of the Schema Registry is unavailable, schema operations will be unavailable. Why is a “Create Cluster” message shown on the UI when I try to enable Stream Governance, if I already have Kafka clusters present in the environment? : If you see this message, then it is possible that this environment was created using an older version of of the Confluent CLI (v3 or lower) or Terraform (v1). In this case, update your [CLI](https://docs.confluent.io/confluent-cli/current/confluent-cli/current/migrate.html) to version 4 or higher and [Terraform](../../clusters/terraform-provider.md#confluent-terraform-provider) to version 2 or higher.
To use Schema Registry with a private endpoint, use CLI version 4.21.0 and Terraform version 2.23.0.
To resolve this issue, you could use the deprecated Schema Registry cluster management (SRCM) v2 regions API only as a workaround to provision the Schema Registry cluster or contact Confluent support to provision a Schema Registry cluster. To learn more about the v2 and v3 SRCM regions APIs, see [Upgrade to SRCM v3 clusters and regions APIs (Deprecation of SRCM v2)](../../stream-governance/packages.md#update-srcm-api-to-v3).