# Storage with Tableflow in Confluent Cloud Apache Iceberg™ and Delta Lake tables managed by Tableflow are stored in Confluent Managed Storage or in a custom storage provider, which is referred to as “external object storage”, “Bring Your Own Storage”, or “Bring Your Own Bucket”. ## Confluent Managed Storage Tableflow can store your Iceberg tables in Confluent Managed Storage. Confluent Managed Storage is Confluent’s’ “batteries included” storage option for Tableflow. There are no additional configurations required to use Confluent Managed Storage with Tableflow. Access to Confluent Managed Storage and your Tableflow-enabled Iceberg tables is controlled by your Confluent Cloud Access Controls [Confluent Cloud Access Controls](../../../security/access-control/overview.md#control-access-overview). ### Encryption with self-managed keys For clusters with self-managed encryption keys (BYOK), Tableflow with Confluent Managed Storage automatically inherits the same encryption key. For detailed information about encryption behavior, setup workflows, and validation procedures, see [Use self-managed encryption keys with Tableflow](../../../security/encrypt/byok/tableflow-byok.md#tableflow-byok-integration). To access tables stored in Confluent Managed Storage, you must use a query engine that supports the Iceberg REST API and vended credentials. [Apache Spark®](https://spark.apache.org/) and [Trino](https://trino.io/) are query engines that work with Confluent Managed Storage. Tableflow tables that use Confluent Managed Storage are not compatible with external catalogs, like AWS Glue. ## Bring Your Own Storage (BYOS) The Bring Your Own Storage (BYOS) feature in Tableflow enables you to leverage your existing storage solutions, such as Amazon S3 Buckets or Azure Data Lake Storage Gen2, for managing data. This flexibility ensures that you can maintain control over your data storage while benefiting from Tableflow’s powerful data management capabilities. To use BYOS, Tableflow requires a [provider integration](../../../connectors/provider-integration.md#cloud-pi-quickstart) to be configured at the environment level of the topic you’re enabling Tableflow on. Multiple Tableflow-enabled topics can use the same storage and provider integration. Your storage must be located in the same region as your Kafka cluster. #### IMPORTANT You should start with an empty bucket when you first enable Tableflow. Existing objects in the bucket may cause Tableflow to fail to start or may be lost entirely during initialization. Do not directly modify or delete objects from this bucket. Doing so may lead to table corruption. ### Amazon S3 storage encryption If your Amazon S3 destination storage uses self-managed encryption keys (SSE-KMS or DSSE-KMS), see [Use self-managed encryption keys with Tableflow](../../../security/encrypt/byok/tableflow-byok.md#tableflow-byok-integration) for KMS permission requirements and setup procedures. Once you have enabled Tableflow on a topic with an Amazon S3 bucket as the storage, you can’t update that Tableflow-enabled topic to use another bucket or to use Confluent Managed Storage. ### Azure storage encryption Tableflow works with Azure Storage with service-side encryption (SSE). This can be utilized transparently and without any additional configurations in Tableflow. For more information, see [Azure Storage encryption for data at rest](https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption). ## Disable Tableflow When you disable Tableflow on a topic, Tableflow stops materializing new data to the table, but it doesn’t delete the existing table files immediately. Cleanup is asynchronous: Tableflow expires snapshots according to the table’s snapshot retention configuration, which defaults to seven days, and removes the data files that no remaining snapshot needs. Because cleanup runs periodically rather than on a fixed deadline, expect the files to persist for at least the retention period after you disable Tableflow. For how to change retention, see [Snapshot retention](../operate/configure-tableflow.md#tableflow-configure). Tableflow doesn’t provide user-facing controls to delete these files immediately. If you need the data removed sooner, or you need to re-enable Tableflow on the topic before cleanup finishes, file a [support request](https://support.confluent.io/hc/en-us/requests/new). If you bring your own storage, you can delete the objects yourself. For the steps, see [Configure Storage for Tableflow](../how-to-guides/configure-storage.md#cloud-tableflow-storage). ## Next steps - [Configure Storage for Tableflow](../how-to-guides/configure-storage.md#cloud-tableflow-storage) - [Quick Start with Managed Storage](../get-started/quick-start-managed-storage.md#cloud-tableflow-quick-start-managed-storage) - [Quick Start Using Your Storage](../get-started/quick-start-custom-storage-glue.md#cloud-tableflow-quick-start) ## Related content - [Grant Role-Based Access](../operate/tableflow-rbac.md#tableflow-rbac) - [Monitor Tableflow](../operate/monitor-tableflow.md#tableflow-monitor) - [Supported Cloud Regions](../overview.md#tableflow-cloud-regions) #### NOTE This website includes content developed at the [Apache Software Foundation](https://www.apache.org/) under the terms of the [Apache License v2](https://www.apache.org/licenses/LICENSE-2.0.html).