# Grant Role-Based Access for Tableflow in Confluent Cloud Tableflow supports [Role-based Access Control (RBAC)](../../../security/access-control/rbac/overview.md#cloud-rbac) for managing Tableflow resources. In general, there are no Tableflow-specific roles to configure, and access to Tableflow typically mirrors access to Apache Kafka® resources. Tableflow supports two primary user access patterns: admin users and topic owner users. ## Tableflow admin users Users with administrative roles (OrganizationAdmin, EnvironmentAdmin, CloudClusterAdmin) have full control over Tableflow, including: - Managing catalog integrations (AWS Glue, Snowflake Polaris) - Enabling or disabling Tableflow on any topic - Accessing metrics and monitoring - Accessing all Tableflow features in the Confluent Cloud console - Managing Bring Your Own Bucket (BYOB) configurations **Minimum permissions required** To grant administrator access to a Tableflow user, assign the following permissions: - CloudClusterAdmin on the cluster - Assigner or ResourceOwner on all provider integrations (environment scope) - DeveloperRead on all schema subjects for schema validation ## Tableflow topic owner users Topic owner users have limited access to only those resources that they own. Users with ResourceOwner role on specific topics can enable Tableflow on the topics they own, but with limitations: - Can enable or disable Tableflow on topics they own - Can view Tableflow status for their topics **Minimum permissions required** To grant topic owner access to a Tableflow user, assign the following permissions: - ResourceOwner on specific topics - DeveloperRead on all schema subjects for schema validation - Assigner on provider integrations to access Tableflow Hub UI ### Access to Tableflow resources The following table shows the roles, scope, and permitted management operations of Tableflow. | Roles | Scope | Enable/Disable/Update Tableflow with Confluent storage | Enable/Disable/Update Tableflow with custom storage | List table | Data plane read | |----------------------|---------------|----------------------------------------------------------|-------------------------------------------------------|--------------|-------------------| | OrganizationAdmin | Organization | Yes | Yes | Yes | Yes | | EnvironmentAdmin | Environment | Yes | Yes | Yes | Yes | | CloudClusterAdmin | Cloud cluster | Yes ^[1](#id5) | Yes ^[2](#id6) | Yes | Yes | | ResourceOwner | Topic | Yes ^[1](#id5) | Yes ^[2](#id6) | Yes | Yes | | OrganizationOperator | Organization | No | No | Yes | No | | EnvironmentOperator | Environment | No | No | Yes | No | | CloudClusterOperator | Cloud cluster | No | No | Yes | No | | DeveloperManage | Cluster | No | No | Yes | No | | DeveloperRead | Cluster | No | No | No | Yes | | Others | No | No | No | No | No | * **[1]** With DeveloperRead access on all schema subjects * **[2]** With DeveloperRead access on all schema subjects and Assigner access on provider integrations ### TableflowTopics APIs TableflowTopics APIs enable managing Tableflow for a topic. These management operations include: - CREATE: Enable Tableflow for a topic and set the configurations. - UPDATE: Update the Tableflow configurations for a topic. - DELETE: Disable Tableflow for a topic. - GET: Get the current Tableflow status for a topic along with the configurations. - LIST: Get the Tableflow status and configurations for all topics in a cluster. ### Catalog Integration APIs Catalog Integration APIs enable managing the external catalog integrations, like AWS Glue Data Catalog and Snowflake Polaris. The following table shows the roles, scopes, and permitted catalog integration management operations for RBAC roles. | Roles | Scope | Create/Update/Delete Catalog Integration | View Catalog Integration | |-------------------|---------------|--------------------------------------------|----------------------------| | CloudClusterAdmin | Cloud cluster | Yes ^[3](#id8) | Yes | | EnvironmentAdmin | Environment | Yes | Yes | | OrganizationAdmin | Organization | Yes | Yes | | Others | | No | No | * **[3]** With ProviderIntegrationResourceOwner or ProviderIntegrationAssigner roles for Glue ### Notification access Notification access for Tableflow topics follows the general Confluent Cloud notification model. The following table shows the roles, scope, and permitted notification management operations for Tableflow. | Roles | Scope | Subscribe to Notifications | Manage Delivery Channels | |-------------------|--------------|------------------------------|----------------------------| | ResourceOwner | Topic | Yes ^[4](#id10) | No | | OrganizationAdmin | Organization | Yes | Yes | | Others | | No | No | * **[4]** Requires the Tableflow notifications feature to be enabled for the organization. For steps to configure integrations and subscribe to Tableflow notifications, see [Notifications for Confluent Cloud](../../../monitoring/configure-notifications.md#ccloud-notifications). ### Related content - [Monitor Tableflow](monitor-tableflow.md#tableflow-monitor) - [Supported Cloud Regions](../overview.md#tableflow-cloud-regions) - [Tableflow Storage](../concepts/tableflow-storage.md#tableflow-storage) - [Notifications for Confluent Cloud](../../../monitoring/configure-notifications.md#ccloud-notifications) #### NOTE This website includes content developed at the [Apache Software Foundation](https://www.apache.org/) under the terms of the [Apache License v2](https://www.apache.org/licenses/LICENSE-2.0.html).