Confluent

Overview

The Veza integration for Confluent enables the discovery of Users, Groups, Roles, Clusters, and Environments from the Confluent platform. Veza uses Confluent APIs to populate the Authorization Graph with entities and metadata.

This document explains how to enable and create a Confluent integration. See Notes and Supported Entities for more details.

Configuring Confluent

Before adding the integration to Veza, create a Confluent Cloud API key for the connection.

Refer to Cloud API Keys for up-to-date instructions for creating an API key.

Using Confluent Cloud Console:

1. Before creating an API key associated with a service account, use RBAC to restrict access to applications that use the key.

2. From the Administration menu, click Cloud API keys or go to https://confluent.cloud/settings/api-keys.

3. Click Add key.

4. Choose Granular Access as the scope.

5. Choose whether to create the key associated with your user account or a service account.

   The API key and secret are generated and displayed.

6. Click Copy to copy the key and secret to a secure location.

   Important:

   The secret for the key is only exposed initially in the Create API key dialog and cannot be viewed or retrieved later from the web interface. Store the secret and its corresponding key in a secure location. Do not share the secret for your API key.

7. (Optional, but recommended) Enter a description of the API key to describe the intended use and distinguish it from other API keys.

8. Select the check box to confirm you have saved your key and secret.

9. Click Save. The key is added to the keys table.

Using Confluent CLI:

1. Sign in to your cluster using the confluent login command.

   Copy

   confluent login

   Enter your Confluent Cloud credentials:

   Copy

   Email: [email protected]
   Password: ********

2. Before creating a Cloud API key associated with a service account, use RBAC to restrict access to applications that use the key.

3. Create the Cloud API key using the confluent api-key create command, specifying the resource (--resource) as cloud. By default, this associates the key with your user account. If you want to associate the key with a service account instead, specify the service account flag (--service-account). A description (--description) is optional but recommended.

   Copy

   confluent api-key create --resource cloud --description <key-description> --service-account <service-account-id>

4. Save the API key and secret output in a secure location. The secret is not retrievable later.

Record the API Key and API Secret values after creating the key.

Configuring Confluent on the Veza Platform

To enable Veza to gather data from the Confluent Cloud Platform:

1. In Veza, navigate to Configuration > Integrations

2. Click Add Integration and select Confluent as the type of integration to add.

3. Enter the required information and click Create Integration

Notes and Supported Entities

The Confluent integration discovers the following entities and attributes:

Confluent Cluster

Confluent Environment

Confluent Group

Confluent User

Confluent Role

Confluent roles are discovered and assigned to security principals; no additional metadata is gathered.