documentation
Get Started Free
  • Get Started Free
  • Stream
      Confluent Cloud

      Fully-managed data streaming platform with a cloud-native Kafka engine (KORA) for elastic scaling, with enterprise security, stream processing, governance.

      Confluent Platform

      An on-premises enterprise-grade distribution of Apache Kafka with enterprise security, stream processing, governance.

  • Connect
      Managed

      Use fully-managed connectors with Confluent Cloud to connect to data sources and sinks.

      Self-Managed

      Use self-managed connectors with Confluent Platform to connect to data sources and sinks.

  • Govern
      Managed

      Use fully-managed Schema Registry and Stream Governance with Confluent Cloud.

      Self-Managed

      Use self-managed Schema Registry and Stream Governance with Confluent Platform.

  • Process
      Managed

      Use Flink on Confluent Cloud to run complex, stateful, low-latency streaming applications.

      Self-Managed

      Use Flink on Confluent Platform to run complex, stateful, low-latency streaming applications.

Stream
Confluent Cloud

Fully-managed data streaming platform with a cloud-native Kafka engine (KORA) for elastic scaling, with enterprise security, stream processing, governance.

Confluent Platform

An on-premises enterprise-grade distribution of Apache Kafka with enterprise security, stream processing, governance.

Connect
Managed

Use fully-managed connectors with Confluent Cloud to connect to data sources and sinks.

Self-Managed

Use self-managed connectors with Confluent Platform to connect to data sources and sinks.

Govern
Managed

Use fully-managed Schema Registry and Stream Governance with Confluent Cloud.

Self-Managed

Use self-managed Schema Registry and Stream Governance with Confluent Platform.

Process
Managed

Use Flink on Confluent Cloud to run complex, stateful, low-latency streaming applications.

Self-Managed

Use Flink on Confluent Platform to run complex, stateful, low-latency streaming applications.

Learn
Get Started Free
  1. Home
  2. Cloud
  3. Process Data with Confluent Cloud for Apache Flink
  4. Operate and Deploy Confluent Cloud for Apache Flink

CLOUD

  • Overview
  • Get Started
    • Overview
    • Quick Start
    • REST API Quick Start
    • Manage Schemas
    • Deploy Free Clusters
    • Tutorials and Examples
      • Overview
      • Example: Use Replicator to Copy Kafka Data to Cloud
      • Example: Create Fully-Managed Services
    • Use Docs with AI Tools
  • Manage Kafka Clusters
    • Overview
    • Cluster Types
    • Manage Configuration Settings
    • Cloud Providers and Regions
    • Resilience
    • Copy Data with Cluster Linking
      • Overview
      • Quick Start
      • Use Cases and Tutorials
        • Share Data Across Clusters, Regions, and Clouds
        • Disaster Recovery and Failover
        • Create Hybrid Cloud and Bridge-to-Cloud Deployments
        • Use Tiered Separation of Critical Workloads
        • Migrate Data
        • Manage Audit Logs
      • Configure, Manage, and Monitor
        • Configure and Manage Cluster Links
        • Manage Mirror Topics
        • Manage Private Networking
        • Manage Security
        • Monitor Metrics
      • FAQ
      • Troubleshooting
    • Copy Data with Replicator
      • Quick Start
      • Use Replicator to Migrate Topics
    • Resize a Dedicated Cluster
    • Multi-Tenancy and Client Quotas
      • Overview
      • Quick Start
    • Create Cluster Using Terraform
    • Terraform Security Best Practices
    • Create Cluster Using Pulumi
    • Connect Confluent Platform and Cloud Environments
      • Overview
      • Connect Self-Managed Gateway to Cloud
        • Confluent Cloud Gateway Overview
        • Configure and Deploy
          • Overview
          • Configure and Deploy using Docker
          • Configure and Deploy using CFK
          • Configure Security using Docker
          • Configure Security using CFK
        • Migrate Kafka Clusters
        • Set up Network Isolation and Custom Domains
      • Connect Self-Managed Control Center to Cloud
      • Connect Self-Managed Clients to Cloud
      • Connect Self-Managed Connect to Cloud
      • Connect Self-Managed REST Proxy to Cloud
      • Connect Self-Managed ksqlDB to Cloud
      • Connect Self-Managed MQTT to Cloud
      • Connect Self-Managed Schema Registry to Cloud
      • Connect Self-Managed Streams to Cloud
      • Example: Autogenerate Self-Managed Component Configs for Cloud
    • Migrate with kcp
    • FAQ
  • Build Streaming Applications
    • Overview
    • Architectural Considerations
    • Client Quick Start
    • Configure Clients
      • Consumer
      • Share Consumers
      • Producer
      • Configuration Properties
    • Test and Monitor a Client
      • Test
      • Monitor
        • Overview
        • Monitoring with JMX
        • Configure JMX
        • Producer Metrics
        • Consumer Metrics
        • Share Consumer Metrics
      • Reset Offsets
    • Optimize and Tune
      • Overview
      • Throughput
      • Latency
      • Durability
      • Availability
      • Freight
    • Client Guides
      • Python
      • .NET Client
      • JavaScript Client
      • Go Client
      • C++ Client
      • Java Client
    • Kafka Client APIs for Confluent Cloud
      • Python Client API
      • .NET Client API
      • JavaScript Client API
      • Go Client API
      • C++ Client API
      • Java Client API
    • Deprecated Client APIs
    • Client Examples
      • Overview
      • Python Client
      • .NET Client
      • JavaScript Client
      • Go Client
      • C++ Client
      • Java
      • Spring Boot
      • KafkaProducer
      • REST
      • Clojure
      • Groovy
      • Kafka Connect Datagen
      • kafkacat
      • Kotlin
      • Ruby
      • Rust
      • Scala
    • Confluent Plugin for JetBrains IDEs
    • VS Code Extension
  • Build Kafka Streams Applications
    • Overview
    • Quick Start
    • Metrics
    • Monitor Applications
    • Upgrade Guide
    • ksqlDB
      • Create Stream Processing Apps with ksqlDB
      • Quick Start
      • Enable ksqlDB Integration with Schema Registry
      • ksqlDB Cluster API Quick Start
      • Monitor ksqlDB
      • Manage ksqlDB by using the CLI
      • Manage Connectors With ksqlDB
      • Develop ksqlDB Applications
      • Pull Queries
      • Grant Role-Based Access
      • Migrate ksqlDB Applications on Confluent Cloud
  • AI and ML
    • Overview
    • Build AI with Confluent Intelligence
      • Overview
      • Streaming Agents
        • Overview
        • Agent Runtime Guide
        • Call Tools
        • Create and Run Streaming Agents
        • Manage Agents in the Console
        • Reflection Workflows
        • Monitor Streaming Agents
        • Debug Streaming Agents
        • Examples
      • Real-Time Context Engine
        • Overview
        • Get Started
        • Manage
        • Query Data
        • Manage Access
        • Support and Limitations
      • Built-in AI/ML Functions
        • Overview
        • Analyze Sentiment
        • Detect Anomalies
        • Detect PII
        • Forecast Trends
        • Invoke a Tool in an AI Workflow
        • ML Preprocessing Functions
        • Model Inference Functions
      • Create Embeddings
        • Overview
        • Create Embeddings
      • Run a Managed AI Model
      • Run a Remote AI Model
      • Search External Tables
        • Overview
        • Key Search with External Sources
        • Text Search with External Sources
        • Vector Search with External Sources
      • FAQ
    • Use AI Tools with Confluent
      • Overview
      • Access Confluent Cloud with the Managed MCP Servers
      • Build with the Open-Source MCP Server
      • Build with Agent Skills
  • Manage Topics
    • Overview
    • Configuration Reference
    • Message Browser
    • Share Streams
      • Overview
      • Provide Stream Shares
      • Consume Stream Shares
    • Tableflow
      • Overview
      • Concepts
        • Overview
        • Storage
        • Schemas
        • Materialize Change Data Capture Streams
        • Billing
        • Write Modes
      • Get Started
        • Overview
        • Quick Start with Managed Storage
        • Quick Start Using Your Storage and AWS Glue
        • Quick Start with Delta Lake Tables
      • How-to Guides
        • Overview
        • Configure Storage
        • Integrate Catalogs
          • Overview
          • Integrate with AWS Glue Catalog
          • Integrate with Snowflake Open Catalog or Apache Polaris
          • Integrate with Unity Catalog
          • User-defined namespaces
        • Query Data
          • Overview
          • Query with AWS
          • Query with DuckDB
          • Query with Flink
          • Query with Snowflake
          • Query with Trino
      • Operate
        • Overview
        • Configure
        • Grant Role-Based Access
        • Monitor
        • Use Private Networking
        • Use Private Networking with Azure
        • Supported Cloud Regions
    • Real-Time Context Engine
    • FAQ
  • Manage and Monitor Resources with USM
    • Overview
    • Register Confluent Platform with USM
      • Overview
      • Set Up Payment Method
      • Configure Private Networking
      • Configure a Service Account
      • Deploy the USM Agent
      • Complete the Cluster Registration
    • Register Confluent Platform Connect Cluster with USM
    • Monitor Confluent Platform Resources
      • Overview
      • Clusters
      • Topics
      • Connectors
      • Consumer Lag
    • Data Governance for Confluent Platform
    • Remove the USM Agent
    • Troubleshoot
  • Govern Data Streams
    • Overview
    • Stream Governance
      • Manage Governance Packages
      • Data Portal
      • Track Data with Stream Lineage
      • Manage Stream Catalog
        • Stream Catalog User Guide
        • REST API Catalog Usage and Examples Guide
        • GraphQL API Catalog Usage and Examples Guide
    • Manage Schemas
      • Overview
      • Manage Schemas
      • Delete Schemas and Manage Storage
      • Use Broker-Side Schema ID Validation
      • Schema Linking
      • Schema Registry Tutorial
    • Fundamentals
      • Key Concepts
      • Schema Evolution and Compatibility
      • Schema Formats
        • Serializers and Deserializers Overview
        • Avro
        • Protobuf
        • JSON Schema
      • Data Contracts
      • Security Considerations
      • Enable Private Networking
        • Enable Private Networking with Schema Registry PrivateLink
        • Enable Private Networking for Schema Registry with a Public Endpoint
    • Reference
      • Overview
      • Configure Clients
      • Schema Registry C++ Client (libschemaregistry)
      • Maven Plugin
      • REST API Usage Examples
      • Use AsyncAPI to Describe Topics and Schemas
    • FAQ
  • Connect to External Services
    • Overview
    • Install Connectors
      • ActiveMQ Source
      • AlloyDB Sink
      • Amazon CloudWatch Logs Source
      • Amazon CloudWatch Metrics Sink
      • Amazon DocumentDB Sink
        • Configure and Launch
        • Configure with AWS Egress PrivateLink Endpoints
      • Amazon DynamoDB CDC Source
        • Configure and Launch
        • Configure with AWS Egress PrivateLink Endpoints
      • Amazon DynamoDB Sink
      • Amazon Kinesis Source
      • Amazon Redshift Sink
      • Amazon S3 Sink
        • Configure and Launch
        • Configure with AWS Egress PrivateLink Endpoints
      • Amazon S3 Source
      • Amazon SQS Source
      • AWS Lambda Sink
      • Azure Blob Storage Sink
        • Configure and Launch
        • Configure with Azure Egress Private Link Endpoints
      • Azure Blob Storage Source
      • Azure Cognitive Search Sink
      • Azure Cosmos DB Sink [Deprecated]
      • Azure Cosmos DB Sink V2
      • Azure Cosmos DB Source [Deprecated]
      • Azure Cosmos DB Source V2
      • Azure Data Lake Storage Gen2 Sink
      • Azure Event Hubs Source
      • Azure Functions Sink
      • Azure Log Analytics Sink
      • Azure Log Analytics Sink V2
      • Azure Service Bus Source
      • Azure Synapse Analytics Sink
      • ClickHouse Sink
        • Configure and Launch
        • Configure with AWS Egress PrivateLink Endpoints
        • Configure with Azure Egress Private Link Endpoints
        • Configure with Google Cloud Private Service Connect Endpoints
      • Couchbase Source
        • Configure and Launch
        • Configure with AWS Egress PrivateLink Endpoints
        • Configure with Azure Egress Private Link Endpoints
        • Configure with GCP Egress Private Service Connect Endpoints
      • Couchbase Sink
        • Configure and Launch
        • Configure with AWS Egress PrivateLink Endpoints
        • Configure with Azure Egress Private Link Endpoints
        • Configure with GCP Egress Private Service Connect Endpoints
      • Databricks Delta Lake Sink
        • Set up Databricks Delta Lake (AWS) Sink Connector for Confluent Cloud
        • Configure and launch the connector
      • Datadog Metrics Sink
      • Datagen Source (development and testing)
      • Elasticsearch Service Sink [Deprecated]
      • Elasticsearch Service Sink V2
        • Configure and Launch
        • Configure with AWS Egress PrivateLink Endpoints
        • Configure with Google Cloud Private Service Connect Endpoints
        • Configure with Azure Egress Private Link Endpoints
      • GitHub Source
      • Google BigQuery Sink [End of Life]
      • Google BigQuery Sink V2
      • Google Cloud BigTable Sink
      • Google Cloud Dataproc Sink [End of Life]
      • Google Cloud Firestore Sink
      • Google Cloud Functions Gen 2 Sink
      • Google Cloud Functions Sink [End of Life]
      • Google Cloud Pub/Sub Source
      • Google Cloud Spanner Sink
      • Google Cloud Storage Sink
      • Google Cloud Storage Source
      • HTTP Sink
      • HTTP Sink V2
      • HTTP Source
      • HTTP Source V2
      • IBM Db2 Source (JDBC)
      • IBM MQ Sink
      • IBM MQ Source
      • InfluxDB 2 Sink
      • InfluxDB 2 Source
      • InfluxDB 3 Sink
      • Jira Source
      • MariaDB CDC Source (Debezium)
      • Microsoft SQL Server CDC Source (Debezium) [End of Life]
      • Microsoft SQL Server CDC Source V2 (Debezium)
        • Configure and launch the connector
        • Backward incompatibility considerations
      • Microsoft SQL Server Sink (JDBC)
      • Microsoft SQL Server Source (JDBC)
      • MongoDB Atlas Sink
        • Configure and Launch
        • Configure with AWS Egress PrivateLink Endpoints
        • Configure with Azure Egress Private Link Endpoints
        • Configure with Google Cloud Egress Private Service Connect Endpoints
      • MongoDB Atlas Source
      • MongoDB CDC Source (Debezium)
        • Configure and Launch
        • Configure with AWS Egress PrivateLink Endpoints
        • Configure with Azure Egress Private Link Endpoints
        • Configure with Google Cloud Egress Private Service Connect Endpoints
      • MQTT Sink
      • MQTT Source
      • MySQL CDC Source (Debezium) [End of Life]
      • MySQL CDC Source V2 (Debezium)
        • Configure and Launch the connector
        • Backward Incompatible Changes
      • MySQL Sink (JDBC)
      • MySQL Source (JDBC)
      • Neo4j Sink
        • Configure and Launch
        • Configure with AWS Egress PrivateLink Endpoints
        • Configure with Google Cloud Private Service Connect Endpoints
      • New Relic Metrics Sink
      • OpenSearch Sink
      • Oracle XStream CDC Source
        • Overview
        • Configure and Launch the connector
        • Oracle Database Prerequisites
        • Change Events
        • Signals and Actions
        • Examples
        • Troubleshooting
      • Oracle CDC Source
        • Overview
        • Configure and Launch the connector
        • Horizontal Scaling
        • Oracle Database Prerequisites
        • SMT Examples
        • DDL Changes
        • Troubleshooting
      • Oracle Database Sink (JDBC)
      • Oracle Database Source (JDBC)
      • PagerDuty Sink [End of Life]
      • Pinecone Sink
      • PostgreSQL CDC Source (Debezium) [End of Life]
      • PostgreSQL CDC Source V2 (Debezium)
        • Configure and Launch the connector
        • Backward Incompatible Changes
      • PostgreSQL Sink (JDBC)
      • PostgreSQL Source (JDBC)
      • RabbitMQ Sink
      • RabbitMQ Source
      • Redis Sink [Deprecated]
      • Redis Kafka Sink
      • Redis Kafka Source
      • Salesforce Bulk API 2.0 Sink
      • Salesforce Bulk API 2.0 Source
      • Salesforce Bulk API Source
      • Salesforce CDC Source
      • Salesforce Platform Event Sink
      • Salesforce Platform Event Source
      • Salesforce PushTopic Source
      • Salesforce SObject Sink
      • Salesforce Source V2
      • ServiceNow Sink
      • ServiceNow Source (Legacy) [Deprecated]
      • ServiceNow Source V2
      • SFTP Sink
      • SFTP Source
      • Snowflake Sink
        • Configure and Launch
        • Configure with AWS Egress PrivateLink Endpoints
        • Configure with Azure Egress Private Link Endpoints
        • Configure with Google Cloud Private Service Connect Endpoints
      • Snowflake Source
        • Configure and Launch
        • Configure with AWS Egress PrivateLink Endpoints
        • Configure with Azure Egress Private Link Endpoints
        • Configure with Google Cloud Private Service Connect Endpoints
      • Solace Sink
      • Solace Source
      • Splunk Sink
      • Zendesk Source
    • Confluent Marketplace
      • Overview
      • Component Archive Specification
      • Contribute
    • Install Custom Plugins and Custom Connectors
      • Overview
      • Quick Start
      • Manage Custom Connectors
      • Limitations and Support
      • API and CLI
    • Manage Client-Side Encryption
    • Manage Provider Integration
    • Secret Manager Integration
      • Overview
      • Azure Key Vault Integration
      • AWS Secrets Manager Integration
    • Networking and DNS
      • Overview
      • AWS Egress PrivateLink Endpoints for First-Party Services
      • AWS Egress PrivateLink Endpoints for Self-Managed Services
      • AWS Egress PrivateLink Endpoints for Amazon RDS
      • AWS Egress PrivateLink Endpoints for Amazon DocumentDB
      • Azure Egress Private Link Endpoints for First-Party Services
      • Azure Egress Private Link Endpoints for Self-Managed Services
      • Google Cloud Private Service Connect Endpoints for First-Party Services
      • Google Cloud Private Service Connect Endpoints for Self-Managed Services
    • Connect API Usage
    • Manage Public Egress IP Addresses
    • Sample Connector Output
    • Configure Single Message Transforms
    • Configure Custom SMTs
      • Quick Start
      • Manage Custom SMT APIs
      • Limitations and Support
    • View Connector Events
    • Interpret Connector Statuses
    • Manage Service Accounts
    • Configure RBAC
    • View Errors in the Dead Letter Queue
    • Connector Limits
    • Manage Offsets
    • Migrate Self-Managed Connectors
    • Transforms List
      • Overview
      • AdjustPrecisionAndScale
      • BytesToString
      • Cast
      • ChangeTopicCase
      • Drop
      • DropHeaders
      • EventRouter
      • ExtractField
      • ExtractNestedField
      • ExtractTimeStamp
      • ExtractTopic
      • ExtractXPath
      • Filter (Kafka)
      • Filter (Confluent)
      • Flatten (Kafka)
      • Flatten (Confluent)
      • FromXML
      • HeaderFrom
      • HeaderToValue
      • HoistField
      • InsertField
      • InsertHeader
      • KeyToValue
      • MaskField
      • MessageTimestampRouter
      • ReplaceField (Kafka)
      • ReplaceField (Confluent)
      • SetMaximumPrecision
      • SetSchemaMetadata
      • TimestampConverter
      • TimestampNow
      • TimestampNowField
      • TimestampRouter
      • TimescaleDB
      • TimezoneConverter
      • TombstoneHandler
      • TopicRegexRouter
      • ValueToKey
    • Reference
      • Additional Connector Configuration
      • Confluent AI-Assisted Troubleshooting
  • Integrate with Confluent Cloud
    • Overview
    • Connect with Confluent Program
    • Reuse Connections with External Services
      • Overview
      • Supported External Services
      • Manage Connections
    • Integrate with Cloud Service Providers
      • Overview
      • Create an AWS Provider Integration
      • Create an Azure Provider Integration
      • Create a Google Cloud Provider Integration
      • Manage a Provider Integration
  • Process Data with Flink
    • Overview
    • Get Started
      • Overview
      • Quick Start with Cloud Console
      • Quick Start with SQL Shell in Confluent CLI
      • Quick Start with Java Table API
      • Quick Start with Python Table API
    • Concepts
      • Overview
      • Autopilot
      • Batch and Stream Processing
      • Billing
      • Comparison with Apache Flink
      • Compute Pools
      • Delivery Guarantees and Latency
      • Determinism
      • External Tables
      • Materialized Tables
      • Private Networking
      • Process Table Functions
      • Schema and Statement Evolution
      • Security Controls
      • Snapshot Queries
      • Statements
      • Statement CFU Metrics
      • Tables and Topics
      • Time and Watermarks
      • User-defined Functions
    • How-To Guides
      • Overview
      • Aggregate a Stream in a Tumbling Window
      • Combine Streams and Track Most Recent Records
      • Compare Current and Previous Values in a Stream
      • Configure a Dead Letter Queue
      • Convert the Serialization Format of a Topic
      • Create a Process Table Function
      • Create a UDF
      • Deduplicate Rows in a Table
      • Deploy a Statement with CI/CD
      • Evolve a Streaming Pipeline
      • Generate Custom Sample Data
      • Handle Late-Arriving Data
      • Handle Multiple Event Types
      • Log Debug Messages in UDFs
      • Mask Fields in a Table
      • Read Records without a Schema ID Prefix
      • Profile a Query
      • Resolve Statement Issues
      • Scan and Summarize Tables
      • Run a Snapshot Query
      • Transform a Topic
      • Use Client-Side Field Level Encryption
      • View Time Series Data
    • Operate and Deploy
      • Overview
      • Carry-over Offsets
      • Deploy with dbt
      • Development Lifecycle
      • Enable Private Networking
      • Generate a Flink API Key
      • Grant Role-Based Access
      • Manage Compute Pools
      • Manage Connections
      • Manage with Terraform
      • Monitor and Manage Statements
      • Move SQL Statements to Production
      • Use the Query Profiler
      • REST API
    • Flink Reference
      • Overview
      • SQL Syntax
      • DDL Statements
        • Statements Overview
        • ALTER AGENT
        • ALTER CONNECTION
        • ALTER MODEL
        • ALTER MATERIALIZED TABLE
        • ALTER TABLE
        • ALTER TOOL
        • ALTER VIEW
        • CREATE AGENT
        • CREATE CONNECTION
        • CREATE FUNCTION
        • CREATE MATERIALIZED TABLE
        • CREATE MODEL
        • CREATE OR ALTER MATERIALIZED TABLE
        • CREATE TABLE
        • CREATE TOOL
        • CREATE VIEW
        • DESCRIBE
        • DROP AGENT
        • DROP CONNECTION
        • DROP FUNCTION
        • DROP MATERIALIZED TABLE
        • DROP MODEL
        • DROP TABLE
        • DROP TOOL
        • DROP VIEW
        • HINTS
        • EXPLAIN
        • RESET
        • SET
        • SHOW
        • USE CATALOG
        • USE database_name
      • DML Statements
        • Queries Overview
        • Deduplication
        • Group Aggregation
        • INSERT INTO FROM SELECT
        • INSERT VALUES
        • Joins
        • LIMIT
        • Pattern Recognition
        • ORDER BY
        • OVER Aggregation
        • SELECT
        • Set Logic
        • EXECUTE STATEMENT SET
        • Top-N
        • Window Aggregation
        • Window Deduplication
        • Window Join
        • Window Top-N
        • Window Table-Valued Function
        • WITH
      • Functions
        • AI Model Inference
        • Aggregate
        • Collections
        • Comparison
        • Conditional
        • Datetime
        • Flink SQL Functions
        • Hashing
        • JSON
        • ML Preprocessing
        • Numeric
        • Search
        • String
        • Table API
      • Data Types
      • Data Type Mappings
      • Time Zone
      • Keywords
      • Information Schema
      • Example Streams
      • Supported Cloud Regions
      • SQL Examples
      • Table API
      • CLI Reference
    • Get Help
    • FAQ
  • Manage Networking
    • Confluent Cloud Networking Overview
    • Networking on AWS
      • AWS Networking Overview
      • Public Networking on AWS
      • Confluent Cloud Network on AWS
      • PrivateLink on AWS
        • PrivateLink Overview
        • Inbound PrivateLink for Dedicated Clusters
        • Inbound PrivateLink for Serverless Products
        • Outbound PrivateLink for Dedicated Clusters
        • Outbound PrivateLink for Serverless Products
      • VPC Peering on AWS
      • Transit Gateway on AWS
      • Private Network Interface on AWS
      • DNS Forwarding on AWS
    • Networking on Azure
      • Azure Networking Overview
      • Public Networking on Azure
      • Confluent Cloud Network on Azure
      • Private Link on Azure
        • Private Link Overview
        • Inbound Private Link for Dedicated Clusters
        • Inbound Private Link for Serverless Products
        • Outbound Private Link for Dedicated Clusters
        • Outbound Private Link for Serverless Products
      • VNet Peering on Azure
    • Networking on Google Cloud
      • Google Cloud Networking Overview
      • Public Networking on Google Cloud
      • Confluent Cloud Network on Google Cloud
      • Private Service Connect on Google Cloud
        • Private Service Connect Overview
        • Inbound Private Service Connect for Dedicated Clusters
        • Inbound Private Service Connect for Serverless Products
        • Outbound Private Service Connect for Dedicated Clusters
      • VPC Peering on Google Cloud
    • Connectivity for Confluent Resources
      • Overview
      • Public Egress IP Address for Connectors and Cluster Linking
      • Cluster Linking using AWS PrivateLink
      • Follower Fetching using AWS VPC Peering
    • Use the Confluent Cloud Console with Private Networking
    • Test Connectivity
    • Networking FAQ
  • Log and Monitor
    • Metrics
    • Manage Metrics Integration APIs
    • Manage Observability Integrations
    • Manage Notifications
    • Monitor Consumer Lag
    • Monitor Dedicated Clusters
      • Manage Performance and Expansion
      • Track Usage by Team
    • Observability for Kafka Clients to Confluent Cloud
    • FAQ
  • Manage Security
    • Overview
    • Manage Authentication
      • Overview
      • Manage User Identities
        • Overview
        • Manage User Accounts
          • Overview
          • Authentication Security Protections
          • Manage Local User Accounts
          • Multi-factor Authentication
          • Manage SSO User Accounts
        • Manage User Identity Providers
          • Overview
          • Use Single Sign-On (SSO)
          • Manage SAML Single Sign-On (SSO)
          • Manage Azure Marketplace SSO
          • Just-in-time User Provisioning
          • Group Mapping
            • Overview
            • Enable Group Mapping
            • Manage Group Mappings
            • Troubleshooting
            • Best Practices
          • Manage Trusted Domains
          • Manage SSO provider
          • Troubleshoot SSO
      • Manage Workload Identities
        • Overview
        • Manage Workload Identities
        • Manage Service Accounts and API Keys
          • Overview
          • Create Service Accounts
          • Manage Service Accounts
          • Manage API Keys
            • Overview
            • Manage API keys
            • Best Practices
            • Troubleshoot
        • Manage OAuth/OIDC Identity Providers
          • Overview
          • Add an OIDC Identity Provider
          • Use OAuth Identity Pools and Filters
          • Manage Identity Provider Configurations
          • Manage the JWKS URI
          • Configure OAuth Clients
            • Overview
            • Go Clients
            • Java Clients
            • JavaScript Clients
            • .NET Clients
            • Python Clients
            • Configuration Reference
            • Configure UAMI
          • Access Kafka REST APIs
          • Use Confluent STS Tokens with REST APIs
          • Best Practices
          • Troubleshoot OAuth Issues
        • Manage mTLS Identity Providers
          • Overview
          • Configure mTLS
          • Manage Certificate Authorities
          • Manage Certificate Identity Pools
          • Create CEL Filters for mTLS
          • Create JSON payloads for mTLS
          • Manage Certificate Revocation
          • Troubleshoot mTLS Issues
    • Control Access
      • Overview
      • Resource Hierarchy
        • Overview
        • Organizations
          • Overview
          • Manage Multiple Organizations
        • Environments
        • Confluent Resource Names (CRNs)
      • Manage Role-Based Access Control
        • Overview
        • Predefined RBAC Roles
        • Manage Role Bindings
        • Use ACLs with RBAC
      • Manage IP Filtering
        • Overview
        • Manage IP Groups
        • Manage IP Filters
        • Best Practices
      • Manage Access Control Lists
        • Overview
        • Operations
        • Examples
        • Troubleshoot
        • Reference
      • Use the Confluent CLI with multiple credentials on Confluent Cloud
    • Encrypt and Protect Data
      • Overview
      • Manage Data in Transit With TLS
      • Use Self-Managed Encryption Keys
        • Overview
        • Use Self-Managed Encryption Keys on AWS
        • Use Self-Managed Encryption Keys on Azure
        • Use Self-Managed Encryption Keys on Google Cloud
        • Manage Key Policies
          • Overview
          • AWS
          • Azure
          • Google Cloud
        • Use Self-Managed Encryption Keys with Tableflow
        • Use Pre-BYOK-API-V1 Self-Managed Encryption Keys
        • Use Confluent CLI for Self-Managed Encryption Keys
        • Use BYOK API for Self-Managed Encryption Keys
        • Revoke Access to Data at Rest
        • Best Practices
        • Troubleshoot Key Policy Issues
      • Use Client-Side Field Level Encryption
        • Overview
        • Manage CSFLE using Confluent Cloud Console
        • Use Client-side Field Level Encryption
        • Configuration Settings
        • Manage Encryption Keys
        • Quick Start
        • Implement a Custom KMS Driver
        • Process Encrypted Data with Apache Flink
        • Code examples
        • Troubleshoot
        • FAQ
      • Use Client-Side Payload Encryption
    • Monitor Activity
      • Concepts
      • Audit Log Event Categories
      • Understand Audit Log Records
      • Audit Log Event Schema
      • Auditable Event Methods
        • Access Transparency
        • Connector
        • Custom Connector Plugin
        • Endpoints
        • Flink
        • Flink Authentication and Authorization
        • IP Filter Authorization
        • Kafka Cluster Authentication and Authorization
        • Kafka Cluster Management and Operations
        • ksqlDB Cluster Authentication and Authorization
        • Networking
        • Notifications Service
        • OAuth/OIDC Identity Provider and Identity Pool
        • Organization
        • Role-based Access Control (RBAC)
        • Real-Time Context Engine
        • Schema Registry Authentication and Authorization
        • Schema Registry Management and Operations
        • Tableflow Data Plane
        • Tableflow Control Plane
        • Unified Stream Manager Control Plane
      • Access and Consume Audit Log Records
      • Access Transparency
      • Retain Audit Logs
      • Best Practices
      • Troubleshoot
    • Access Management Tutorial
  • Manage Billing
    • Overview
    • Billing Dimensions
    • Invoices and Costs
    • Cost Allocation
    • Amazon Web Services
      • Pay As You Go
      • Commitments
    • Google Cloud
      • Pay as you Go
      • Commitments
      • Professional Services
    • Microsoft Azure
      • Pay As You Go
      • Commitments
      • Jio Commitments
      • Professional Services
    • Marketplace Organization Suspension and Deactivation
    • Troubleshoot Billing
    • FAQ
  • Manage Service Quotas
    • Overview
    • Service Quotas
    • View Service Quotas using Confluent CLI
    • Service Quotas API
  • APIs
    • Overview
    • Confluent Cloud API Usage and Reference
      • Overview
      • Confluent Cloud API Reference
      • Metrics API Reference
      • Admin and Produce REST API Usage
      • Connect API Usage
      • Provider Integration API Usage
      • Stream Catalog REST API Usage
      • Service Quotas API Usage
    • Kafka Client API Reference
      • Overview
      • .NET Client API Reference
      • C++ Client API Reference
      • Go Client API Reference
      • Java Client API Reference
      • JavaScript Client API Reference
      • Python Client API Reference
    • Flink Client API Usage and Reference
    • GraphQL API Usage and Reference
  • Confluent CLI
  • Release Notes & FAQ
    • Release Notes
    • FAQ
    • Upgrade Policy
    • Compliance
    • Generate a HAR file for Troubleshooting
    • AI Assistant
  • Support
  • Glossary

Manage Connections in Confluent Cloud for Apache Flink

A connection in Confluent Cloud for Apache Flink® represents an external service that your Flink statements use. Use connections to access external services, such as databases, APIs, and other systems.

To create a connection, you need the OrganizationAdmin, EnvironmentAdmin, or FlinkAdmin RBAC role. For more information, see Grant Role-Based Access in Confluent Cloud for Apache Flink.

For details on reusable connections, see Reuse Confluent Cloud Connections With External Services and Manage Connections with External Services in Confluent Cloud.

Confluent Cloud for Apache Flink makes a best-effort attempt to redact sensitive values from the CREATE CONNECTION and ALTER CONNECTION statements by masking the values for the known sensitive keys. In Confluent Cloud Console, the sensitive values are redacted in the Flink SQL workspace if you navigate away from the workspace and return, or if you reload the page in the browser. Alternatively, you can use the Confluent CLI commands to create and manage connections.

In addition, if syntax in the CREATE CONNECTION statement is incorrect, Confluent Cloud for Apache Flink might not detect the secrets. For example, if you type CREATE CONNECTION my_conn WITH ('ap-key' = 'x'), Flink doesn’t redact the x, because api-key is misspelled.

Create a connection

  1. In the Confluent Cloud Console or in the Flink SQL shell, run the CREATE CONNECTION statement to create a connection.

    The following example creates an OpenAI connection with an API key.

    CREATE CONNECTION `my_connection`
      WITH (
        'type' = 'OPENAI',
        'endpoint' = 'https://<your-endpoint>.openai.azure.com/openai/deployments/<deployment-name>/chat/completions?api-version=2025-01-01-preview',
        'api-key' = '<your-api-key>'
      );
    

    The following example creates a MongoDB connection with basic authorization.

    CREATE CONNECTION `my_mongodb_connection`
      WITH (
        'type' = 'MONGODB',
        'endpoint' = 'mongodb+srv://myCluster.mongodb.net/myDatabase',
    
        'username' = '<atlas-user-name>',
        'password' = '<atlas-password>'
      );
    
  2. Run the CREATE TABLE statement to create a table that uses the connection.

    The following example creates a MongoDB external table that uses the MongoDB connection.

    -- Use the MongoDB connection to create a MongoDB external table.
    CREATE TABLE mongodb_movies_full_text_search (
        title STRING,
        plot STRING
    ) WITH (
        'connector' = 'mongodb',
        'mongodb.connection' = 'my_mongodb_connection',
        'mongodb.database' = 'sample_mflix',
        'mongodb.collection' = 'movies',
        'mongodb.index' = 'default'
    );
    
  1. In the navigation menu, click Environments, and click the tile for the environment where you’re using Flink SQL.

  2. In the navigation menu, click Integrations.

  3. Click Connections, then click Add connection.

    The available services are listed.

  4. Click the tile of the service you want to connect to, and click Continue.

    The Define endpoint and credentials page opens.

  5. In the Endpoint textbox, enter the URL for the service you want to connect to.

  6. In the following fields, enter your credentials, which can be an API key, a username and password pair, or another type of credential, such as a Service Account Key, depending on the service.

  7. Click Continue.

    The Review and launch page opens.

  8. In the Cloud provider and Region dropdowns, select the cloud provider and region where your Flink statements run.

    Important

    You can access the connection only from a workspace that is in the same region as the connection.

  9. Click Create connection.

    The connection is created and you can use it in your Flink statements.

    Note

    You can edit the credentials later, but you can’t change the other properties, such as the cloud provider or region.

Run the confluent flink connection create command to create a connection.

Creating a connection requires the following inputs. Credentials vary by service.

export CONNECTION_NAME="<connection-name>" # human-readable name, for example, "azure-openai_connection"
export CLOUD_PROVIDER="<cloud-provider>" # example: "aws"
export CLOUD_REGION="<cloud-region>" # example: "us-east-1"
export ENV_ID="<environment-id>" # example: "env-a1b2c3"
export CONNECTION_TYPE="<connection-type>" # example: "azureopenai"
export ENDPOINT="<endpoint>" # example: "https://<your-project>.openai.azure.com/openai/deployments/<deployment-name>/chat/completions?api-version=2025-01-01-preview"
export API_KEY="<api-key>"

Run the following command to create a connection in the specified cloud provider and environment.

confluent flink connection create ${CONNECTION_NAME} \
  --cloud ${CLOUD_PROVIDER} \
  --region ${CLOUD_REGION} \
  --environment ${ENV_ID} \
  --type ${CONNECTION_TYPE} \
  --endpoint ${ENDPOINT} \
  --api-key ${API_KEY}

Your output should resemble:

+---------------+------------------------------------+
| Creation Date | 2025-08-13 22:04:57.972969         |
|               | +0000 UTC                          |
| Name          | azure-openai_connection            |
| Environment   | env-a1b2c3                         |
| Cloud         | aws                                |
| Region        | us-west-2                          |
| Type          | AZUREOPENAI                        |
| Endpoint      | https://<your-project-endpoint>    |
| Data          | <REDACTED>                         |
| Status        |                                    |
+---------------+------------------------------------+

Create a connection in your environment by sending a POST request to the Connections endpoint.

Creating a connection requires the following inputs. Credentials vary by service.

export CONNECTION_NAME="<connection-name>" # example: "my-openai_connection"
export CONNECTION_TYPE="<connection-type>" # example: "OPENAI"
export ENDPOINT="<endpoint>" # example: "https://api.openai.com/v1/chat/completions"
export CLOUD_API_KEY="<cloud-api-key>"
export CLOUD_API_SECRET="<cloud-api-secret>"
export BASE64_CLOUD_KEY_AND_SECRET=$(echo -n "${CLOUD_API_KEY}:${CLOUD_API_SECRET}" | base64 -w 0)
export ORG_ID="<organization-id>" # example: "b0b21724-4586-4a07-b787-d0bb5aacbf87"
export ENV_ID="<environment-id>" # example: "env-a1b2c3"
export CLOUD_PROVIDER="<cloud-provider>" # example: "aws"
export CLOUD_REGION="<cloud-region>" # example: "us-east-1"
export JSON_DATA="<payload-string>"

The following JSON shows an example payload. The auth_data key varies by service.

{
  "name": "${CONNECTION_NAME}",
  "spec": {
    "connection_type": "${CONNECTION_TYPE}",
    "endpoint": "${ENDPOINT}",
    "auth_data": {
      "kind": "PlaintextProvider",
      "data": "string"
    }
  },
  "metadata": {}
}

Quotation mark characters in the JSON string must be escaped, so the payload string to send resembles the following:

export JSON_DATA="{
  \"name\": \"${CONNECTION_NAME}\",
  \"spec\": {
    \"connection_type\": \"${CONNECTION_TYPE}\",
    \"endpoint\": \"${ENDPOINT}\",
    \"auth_data\": {
      \"kind\": \"PlaintextProvider\",
      \"data\": \"string\"
    }
  },
  \"metadata\": {}
}"

The following command sends a POST request to create a connection.

curl --request POST \
  --url "https://flink.region.provider.confluent.cloud/sql/v1/organizations/${ORG_ID}/environments/${ENV_ID}/connections" \
  --header "Authorization: Basic ${BASE64_CLOUD_KEY_AND_SECRET}" \
  --header 'content-type: application/json' \
  --data "${JSON_DATA}"

Your output should resemble:

Response from a request to create a connection
{
  "api_version": "sql/v1",
  "kind": "Connection",
  "metadata": {
    "self": "https://flink.us-west1.aws.confluent.cloud/sql/v1/organizations/org-abc/environments/env-a1b2c3/connections/my-openai_connection",
    "resource_name": "",
    "created_at": "2006-01-02T15:04:05-07:00",
    "updated_at": "2006-01-02T15:04:05-07:00",
    "deleted_at": "2006-01-02T15:04:05-07:00",
    "uid": "12345678-1234-1234-1234-123456789012",
    "resource_version": "a23av"
  },
  "name": "my-openai_connection",
  "spec": {
    "connection_type": "OPENAI",
    "endpoint": "https://api.openai.com/v1/chat/completions",
    "auth_data": {
      "kind": "PlaintextProvider",
      "data": "string"
    }
  },
  "status": {
    "phase": "READY",
    "detail": "Lookup failed: ai.openai.com"
     }
   }
}

To create a connection by using the Confluent Terraform provider, use the confluent_flink_connection resource.

  1. Configure your Terraform file. Provide your Confluent Cloud API key and secret.

    terraform {
      required_providers {
        confluent = {
          source = "confluentinc/confluent"
          version = "2.74.0"
        }
      }
    }
    
    provider "confluent" {
      cloud_api_key    = var.confluent_cloud_api_key    # optionally use CONFLUENT_CLOUD_API_KEY env var
      cloud_api_secret = var.confluent_cloud_api_secret # optionally use CONFLUENT_CLOUD_API_SECRET env var
    }
    
  2. Define the confluent_flink_connection resource with the required parameters, such as display_name, cloud, region, and the environment ID.

    resource "confluent_flink_connection" "openai_connection" {
      organization {
          id = data.confluent_organization.main.id
      }
      environment {
          id = data.confluent_environment.staging.id
      }
      compute_pool {
          id = confluent_flink_compute_pool.example.id
      }
      principal {
          id = confluent_service_account.app-manager-flink.id
      }
      rest_endpoint = data.confluent_flink_region.main.rest_endpoint
      credentials {
          key    = confluent_api_key.env-admin-flink-api-key.id
          secret = confluent_api_key.env-admin-flink-api-key.secret
      }
    
      display_name = "connection1"
      type = "OPENAI"
      endpoint = "https://api.openai.com/v1/chat/completions"
      api_key ="API_Key_value"
    
      lifecycle {
          prevent_destroy = true
      }
    }
    
  3. Run the terraform apply command to create the resources.

    terraform apply
    

For more information, see confluent_flink_connection resource.

View details for a connection

In the Confluent Cloud Console or in the Flink SQL shell, run the DESCRIBE CONNECTION statement to get details about a connection.

DESCRIBE CONNECTION `my_connection`;

Your output should resemble:

+---------------+------------------------------------+
| Creation Date | 2025-08-13 22:04:57.972969         |
|               | +0000 UTC                          |
| Name          | azure-openai_connection            |
| Environment   | env-a1b2c3                         |
| Cloud         | aws                                |
| Region        | us-west-2                          |
| Type          | AZUREOPENAI                        |
| Endpoint      | https://<your-project-endpoint>    |
| Data          | <REDACTED>                         |
| Status        |                                    |
+---------------+------------------------------------+
  1. In the navigation menu, click Environments, and click the tile for the environment where you’re using Flink SQL.

  2. In the navigation menu, click Integrations.

  3. Click Connections.

  4. In the listed connections, find the one you want to view. If you have many connections in the list, use the search bar to find the connection.

  5. Click the connection name to view the connection details.

Run the confluent flink connection describe command to get details about a connection.

Describing a connection requires the following inputs:

export CONNECTION_NAME="<connection-name>" # example: "azure-openai_connection"
export CLOUD_PROVIDER="<cloud-provider>" # example: "aws"
export CLOUD_REGION="<cloud-region>" # example: "us-east-1"
export ENV_ID="<environment-id>" # example: "env-a1b2c3"

Run the following command to get details about a connection.

confluent flink connection describe ${CONNECTION_NAME} \
  --cloud ${CLOUD_PROVIDER} \
  --region ${CLOUD_REGION} \
  --environment ${ENV_ID}

Your output should resemble:

+---------------+------------------------------------+
| Creation Date | 2025-08-13 22:04:57.972969         |
|               | +0000 UTC                          |
| Name          | azure-openai_connection            |
| Environment   | env-a1b2c3                         |
| Cloud         | aws                                |
| Region        | us-west-2                          |
| Type          | AZUREOPENAI                        |
| Endpoint      | https://<your-project-endpoint>    |
| Data          | <REDACTED>                         |
| Status        |                                    |
+---------------+------------------------------------+

Get the details about a connection in your environment by sending a GET request to the Connections endpoint.

  • This request uses your Cloud API key instead of the Flink API key.

Getting details about a connection requires the following inputs:

export CONNECTION_NAME="<connection-name>" # example: "my-openai_connection"
export CLOUD_API_KEY="<cloud-api-key>"
export CLOUD_API_SECRET="<cloud-api-secret>"
export BASE64_CLOUD_KEY_AND_SECRET=$(echo -n "${CLOUD_API_KEY}:${CLOUD_API_SECRET}" | base64 -w 0)
export ORG_ID="<organization-id>" # example: "b0b21724-4586-4a07-b787-d0bb5aacbf87"
export ENV_ID="<environment-id>" # example: "env-a1b2c3"

Run the following command to get details about the connection specified in the CONNECTION_NAME environment variable.

curl --request GET \
  --url "https://flink.region.provider.confluent.cloud/sql/v1/organizations/${ORG_ID}/environments/${ENV_ID}/connections/${CONNECTION_NAME}" \
  --header "Authorization: Basic ${BASE64_CLOUD_KEY_AND_SECRET}"

Your output should resemble:

Response from a request to read a connection
{
  "api_version": "sql/v1",
  "kind": "Connection",
  "metadata": {
    "self": "https://flink.us-west1.aws.confluent.cloud/sql/v1/organizations/org-abc/environments/env-123/connections/my-openai_connection",
    "resource_name": "",
    "created_at": "2006-01-02T15:04:05-07:00",
    "updated_at": "2006-01-02T15:04:05-07:00",
    "deleted_at": "2006-01-02T15:04:05-07:00",
    "uid": "12345678-1234-1234-1234-123456789012",
    "resource_version": "a23av"
  },
  "name": "my-openai_connection",
  "spec": {
    "connection_type": "OPENAI",
    "endpoint": "https://api.openai.com/v1/chat/completions",
    "auth_data": {
      "kind": "PlaintextProvider",
      "data": "string"
    }
  },
  "status": {
    "phase": "READY",
    "detail": "Lookup failed: ai.openai.com"
  }
}

To view details for a connection by using the Confluent Terraform provider, use the confluent_flink_connection data source.

data "confluent_flink_connection" "existing_connection" {
  organization {
     id = "<your-organization-id>"
  }
  environment {
     id = "<your-environment-id>"
  }
  compute_pool {
     id = "<your-compute-pool-id>"
  }
  principal {
     id = "<your-service-account-id>"
  }
  rest_endpoint = "<your-flink-rest-endpoint>"
  credentials {
     key    = "<your-flink-api-key>"
     secret = "<your-flink-api-secret>"
  }
  display_name = "my_connection"
  type         = "JDBC"
}

output "connection_endpoint" {
  value = data.confluent_flink_connection.existing_connection.endpoint
}

Run the terraform apply or terraform output command. The connection_endpoint output contains details for the connection.

To inspect specific attributes after your configuration has been applied, run the terraform output command.

terraform output connection_endpoint

For more information, see confluent_flink_connection data source.

List connections

In the Confluent Cloud Console or in the Flink SQL shell, run the SHOW CONNECTIONS statement to list the connections.

SHOW CONNECTIONS;

Your output should resemble:

                Creation Date          |           Name           | Environment | Cloud |  Region   |    Type     |            Endpoint             |    Data    | Status | Status Detail
---------------------------------+--------------------------+-------------+-------+-----------+-------------+---------------------------------+------------+--------+----------------
  2025-08-13 21:05:15.035376     | azureopenai_connection-2 | env-a1b2c3  | aws   | us-west-2 | AZUREOPENAI | https://<your-project-endpoint> | <REDACTED> |        |
  +0000 UTC                      |                          |             |       |           |             |                                 |            |        |
  2025-08-13 22:04:57.972969     | azure-openai_connection  | env-a1b2c3  | aws   | us-west-2 | AZUREOPENAI | https://<your-project-endpoint> | <REDACTED> |        |
  +0000 UTC                      |                          |             |       |           |             |                                 |            |        |
  1. In the navigation menu, click Environments, and click the tile for the environment where you’re using Flink SQL.

  2. In the navigation menu, click Integrations.

  3. Click Connections.

    The available connections are listed.

Run the confluent flink connection list command to list connections in the specified environment.

Listing connections requires the following inputs:

export CLOUD_PROVIDER="<cloud-provider>" # example: "aws"
export CLOUD_REGION="<cloud-region>" # example: "us-east-1"
export ENV_ID="<environment-id>" # example: "env-a1b2c3"

Run the following command to list connections in the specified environment.

confluent flink connection list
  --cloud ${CLOUD_PROVIDER} \
  --region ${CLOUD_REGION} \
  --environment ${ENV_ID}

Your output should resemble:

          Creation Date          |           Name           | Environment | Cloud |  Region   |    Type     |            Endpoint             |    Data    | Status | Status Detail
---------------------------------+--------------------------+-------------+-------+-----------+-------------+---------------------------------+------------+--------+----------------
  2025-08-13 21:05:15.035376     | azureopenai_connection-2 | env-a1b2c3  | aws   | us-west-2 | AZUREOPENAI | https://<your-project-endpoint> | <REDACTED> |        |
  +0000 UTC                      |                          |             |       |           |             |                                 |            |        |
  2025-08-13 22:04:57.972969     | azure-openai_connection  | env-a1b2c3  | aws   | us-west-2 | AZUREOPENAI | https://<your-project-endpoint> | <REDACTED> |        |
  +0000 UTC                      |                          |             |       |           |             |                                 |            |        |

List the connections in your environment by sending a GET request to the Connections endpoint.

  • This request uses your Cloud API key instead of the Flink API key.

Listing the connections in your environment requires the following inputs:

export CLOUD_API_KEY="<cloud-api-key>"
export CLOUD_API_SECRET="<cloud-api-secret>"
export BASE64_CLOUD_KEY_AND_SECRET=$(echo -n "${CLOUD_API_KEY}:${CLOUD_API_SECRET}" | base64 -w 0)
export ORG_ID="<organization-id>" # example: "b0b21724-4586-4a07-b787-d0bb5aacbf87"
export ENV_ID="<environment-id>" # example: "env-a1b2c3"

Run the following command to list the connections in your environment.

curl --request GET \
  --url "https://flink.region.provider.confluent.cloud/sql/v1/organizations/${ORG_ID}/environments/${ENV_ID}/connections" \
  --header "Authorization: Basic ${BASE64_CLOUD_KEY_AND_SECRET}"

Your output should resemble:

Response from a request to list connections
{
  "api_version": "sql/v1",
  "kind": "ConnectionList",
  "metadata": {
    "first": "https://flink.us-west1.aws.confluent.cloud/sql/v1/environments/env-abc123/connections",
    "last": "",
    "prev": "",
    "next": "https://flink.us-west1.aws.confluent.cloud/sql/v1/environments/env-abc123/connections?page_token=UvmDWOB1iwfAIBPj6EYb",
    "total_size": 123,
    "self": "https://flink.us-west1.aws.confluent.cloud/sql/v1/environments/env-123/connections"
  },
  "data": [
    {
      "api_version": "sql/v1",
      "kind": "Connection",
      "metadata": {
        "self": "https://flink.us-west1.aws.confluent.cloud/sql/v1/organizations/org-abc/environments/env-123/connections/my-openai_connection",
        "resource_name": "",
        "created_at": "2006-01-02T15:04:05-07:00",
        "updated_at": "2006-01-02T15:04:05-07:00",
        "deleted_at": "2006-01-02T15:04:05-07:00",
        "uid": "12345678-1234-1234-1234-123456789012",
        "resource_version": "a23av"
      },
      "name": "my-openai_connection",
      "spec": {
        "connection_type": "OPENAI",
        "endpoint": "https://api.openai.com/v1/chat/completions",
        "auth_data": {
          "kind": "PlaintextProvider",
          "data": "string"
        }
     }
   },
   "status": {
     "phase": "READY",
     "detail": "Lookup failed: ai.openai.com"
      }
    }
  ]
}

The Confluent Terraform provider does not support a plural data source or enumeration method that enables you to list all existing connection resources in one operation.

To view all connections, you must use Flink SQL, Confluent Cloud Console, the CLI, or the REST API.

If you use the Flink SQL REST API, you could integrate the response list into Terraform workflows by scripting an external data source that queries the Flink SQL API, and using an external provider, parses the results and feeds them into Terraform. This is a custom integration, not a supported feature.

For more information, see confluent_flink_connection.

Update a connection

You can update only the credentials for a connection.

In the Confluent Cloud Console or in the Flink SQL shell, run the ALTER CONNECTION statement to update the connection.

ALTER CONNECTION `my_connection` SET ('api-key' = '<new-api-key>');

Your output should resemble:

+---------------+------------------------------------+
| Creation Date | 2025-08-13 22:04:57.972969         |
|               | +0000 UTC                          |
| Name          | azure-openai_connection            |
| Environment   | env-a1b2c3                         |
| Cloud         | aws                                |
| Region        | us-west-2                          |
| Type          | AZUREOPENAI                        |
| Endpoint      | https://<your-project-endpoint>    |
| Data          | <REDACTED>                         |
| Status        |                                    |
+---------------+------------------------------------+
  1. In the navigation menu, click Environments, and click the tile for the environment where you’re using Flink SQL.

  2. In the navigation menu, click Integrations.

  3. Click Connections.

  4. In the listed connections, find the one you want to update, and click the options icon (⋮).

  5. In the context menu, click Edit connection.

  6. In the credentials fields, enter the new credentials for the connection.

  7. Click Save changes.

    The connection is updated, and you can use it in your Flink statements.

Run the confluent flink connection update command to update a connection.

Updating a connection requires the following inputs. Credentials vary by service.

export CONNECTION_NAME="<connection-name>" # example: "azure-openai_connection"
export CLOUD_PROVIDER="<cloud-provider>" # example: "aws"
export CLOUD_REGION="<cloud-region>" # example: "us-east-1"
export ENV_ID="<environment-id>" # example: "env-a1b2c3"
export ENDPOINT="<endpoint>" # example: "https://<your-project>.openai.azure.com/openai/deployments/<deployment-name>/chat/completions?api-version=2025-01-01-preview"
export NEWAPI_KEY="<new-api-key>"

Run the following command to update a connection.

confluent flink connection update ${CONNECTION_NAME} \
  --cloud ${CLOUD_PROVIDER} \
  --region ${CLOUD_REGION} \
  --environment ${ENV_ID} \
  --endpoint ${ENDPOINT} \
  --api-key ${NEWAPI_KEY}

Your output should resemble:

+---------------+------------------------------------+
| Creation Date | 2025-08-13 22:04:57.972969         |
|               | +0000 UTC                          |
| Name          | azure-openai_connection            |
| Environment   | env-a1b2c3                         |
| Cloud         | aws                                |
| Region        | us-west-2                          |
| Type          | AZUREOPENAI                        |
| Endpoint      | https://<your-project-endpoint>    |
| Data          | <REDACTED>                         |
| Status        |                                    |
+---------------+------------------------------------+

Update a connection in your environment by sending a PATCH request to the Connections endpoint.

  • This request uses your Cloud API key instead of the Flink API key.

Updating a connection requires the following inputs:

export CONNECTION_NAME="<connection-name>" # example: "my-openai_connection"
export CONNECTION_TYPE="<connection-type>" # example: "OPENAI"
export ENDPOINT="<endpoint>" # example: "https://api.openai.com/v1/chat/completions"
export CLOUD_API_KEY="<cloud-api-key>"
export CLOUD_API_SECRET="<cloud-api-secret>"
export BASE64_CLOUD_KEY_AND_SECRET=$(echo -n "${CLOUD_API_KEY}:${CLOUD_API_SECRET}" | base64 -w 0)
export ORG_ID="<organization-id>" # example: "b0b21724-4586-4a07-b787-d0bb5aacbf87"
export ENV_ID="<environment-id>" # example: "env-a1b2c3"
export CLOUD_PROVIDER="<cloud-provider>" # example: "aws"
export CLOUD_REGION="<cloud-region>" # example: "us-east-1"
export JSON_DATA="<payload-string>"

The following JSON shows an example payload. The auth_data key varies by service.

{
  "name": "${CONNECTION_NAME}",
  "spec": {
    "connection_type": "${CONNECTION_TYPE}",
    "endpoint": "${ENDPOINT}",
    "auth_data": {
      "kind": "PlaintextProvider",
      "data": "string"
    }
  },
  "metadata": {}
}

Quotation mark characters in the JSON string must be escaped, so the payload string to send resembles the following:

export JSON_DATA="{
  \"name\": \"${CONNECTION_NAME}\",
  \"spec\": {
    \"connection_type\": \"${CONNECTION_TYPE}\",
    \"endpoint\": \"${ENDPOINT}\",
    \"auth_data\": {
      \"kind\": \"PlaintextProvider\",
      \"data\": \"string\"
    }
  },
  \"metadata\": {}
}"

The following command sends a PUT request to update a connection.

curl --request PUT \
  --url "https://flink.region.provider.confluent.cloud/sql/v1/organizations/${ORG_ID}/environments/${ENV_ID}/connections/${CONNECTION_NAME}" \
  --header "Authorization: Basic ${BASE64_CLOUD_KEY_AND_SECRET}" \
  --header 'content-type: application/json' \
  --data "${JSON_DATA}"

Your output should resemble:

Response from a request to update a connection
{
  "api_version": "sql/v1",
  "kind": "Connection",
  "metadata": {
    "self": "https://flink.us-west1.aws.confluent.cloud/sql/v1/organizations/org-abc/environments/env-a1b2c3/connections/my-openai_connection",
    "resource_name": "",
    "created_at": "2006-01-02T15:04:05-07:00",
    "updated_at": "2006-01-02T15:04:05-07:00",
    "deleted_at": "2006-01-02T15:04:05-07:00",
    "uid": "12345678-1234-1234-1234-123456789012",
    "resource_version": "a23av"
  },
  "name": "my-openai_connection",
  "spec": {
    "connection_type": "OPENAI",
    "endpoint": "https://api.openai.com/v1/chat/completions",
    "auth_data": {
      "kind": "PlaintextProvider",
      "data": "string"
    }
  },
  "status": {
    "phase": "READY",
    "detail": "Lookup failed: ai.openai.com"
     }
   }
}

To update a connection by using the Confluent Terraform provider, use the confluent_flink_connection resource.

  1. Find the definition for the connection resource in your Terraform configuration, for example:

    resource "confluent_flink_connection" "openai_connection" {
      ...
      credentials {
          api_key    = confluent_api_key.env-admin-flink-api-key.id
      }
    }
    
  2. Modify the attributes of the confluent_flink_connection resource in the Terraform configuration file. The following example updates the api_key attribute.

     resource "confluent_flink_connection" "openai_connection" {
       ...
       credentials {
           api_key    = confluent_api_key.env-admin-flink-api-key.id # Updated value
       }
     }
    
  3. Run the terraform apply command to update the connection with the new configuration.

    terraform apply
    

For more information, see confluent_flink_connection.

Delete a connection

In the Confluent Cloud Console or in the Flink SQL shell, run the DROP CONNECTION statement to delete the connection.

DROP CONNECTION `my_connection`;
  1. In the navigation menu, click Environments, and click the tile for the environment where you’re using Flink SQL.

  2. In the navigation menu, click Integrations.

  3. Click Connections.

  4. In the listed connections, find the one you want to delete, and click the options icon (⋮).

  5. In the context menu, click Delete connection.

  6. In the dialog, enter the connection name, and click Confirm.

    The connection is deleted.

Run the confluent flink connection delete command to delete a connection.

Deleting a connection requires the following inputs:

export CONNECTION_NAME="<connection-name>" # example: "azure-openai_connection"
export CLOUD_PROVIDER="<cloud-provider>" # example: "aws"
export CLOUD_REGION="<cloud-region>" # example: "us-east-1"
export ENV_ID="<environment-id>" # example: "env-a1b2c3"

Run the following command to delete a connection.

confluent flink connection delete ${CONNECTION_NAME} \
  --cloud ${CLOUD_PROVIDER} \
  --region ${CLOUD_REGION} \
  --environment ${ENV_ID}

Your output should resemble:

Deleted Flink connection "azure-openai_connection".

Delete a connection in your environment by sending a DELETE request to the Connections endpoint.

  • This request uses your Cloud API key instead of the Flink API key.

Deleting a connection requires the following inputs:

export CONNECTION_NAME="<connection-name>" # example: "my-openai_connection"
export CLOUD_API_KEY="<cloud-api-key>"
export CLOUD_API_SECRET="<cloud-api-secret>"
export BASE64_CLOUD_KEY_AND_SECRET=$(echo -n "${CLOUD_API_KEY}:${CLOUD_API_SECRET}" | base64 -w 0)
export ORG_ID="<organization-id>" # example: "b0b21724-4586-4a07-b787-d0bb5aacbf87"
export ENV_ID="<environment-id>" # example: "env-a1b2c3"

Run the following command to delete the connection specified in the CONNECTION_NAME environment variable.

curl --request DELETE \
  --url "https://flink.region.provider.confluent.cloud/sql/v1/organizations/${ORG_ID}/environments/${ENV_ID}/connections/${CONNECTION_NAME}" \
  --header "Authorization: Basic ${BASE64_CLOUD_KEY_AND_SECRET}"

To delete a connection by using the Confluent Terraform provider, use the confluent_flink_connection resource.

  1. Find the definition for the connection resource in your Terraform configuration and copy the name of the resource. In the following example, the resource name is main.

    resource "confluent_flink_connection" "main" {
      display_name = "standard_connection"
      ...
      }
    }
    
  2. To avoid accidental deletions, review the plan before applying the destroy command.

    terraform plan -destroy -target=confluent_flink_connection.main
    
  3. To delete the connection, run the following command to target the specific resource. This command deletes only the connection and not other resources.

    terraform apply -destroy -target=confluent_flink_connection.main
    

    To remove all resources defined in your Terraform configuration file, including the connection, run the terraform destroy command.

    terraform destroy
    

For more information, see confluent_flink_connection.

Related content

  • Reuse Confluent Cloud Connections With External Services

  • Manage Connections with External Services in Confluent Cloud

Note

This website includes content developed at the Apache Software Foundation under the terms of the Apache License v2.

Was this doc page helpful?

Give us feedback

Do you still need help?

Confluent support portalAsk the community
Thank you. We'll be in touch!
Be the first to get updates and new content

By clicking "SIGN UP" you agree that your personal data will be processed in accordance with our Privacy Policy.

  • Confluent
  • About
  • Careers
  • Contact
  • Professional Services
  • Product
  • Confluent Cloud
  • Confluent Platform
  • Connectors
  • Flink
  • Stream Governance
  • Developer
  • Free Courses
  • Tutorials
  • Event Streaming Patterns
  • Documentation
  • Blog
  • Podcast
  • Community
  • Forum
  • Meetups
  • Kafka Summit
  • Catalysts
Terms & ConditionsPrivacy PolicyDo Not Sell My InformationModern Slavery PolicyCookie SettingsFeedback

Copyright © Confluent, Inc. 2014- Apache®️, Apache Kafka®️, Kafka®️, Apache Flink®️, Flink®️, Apache Iceberg®️, Iceberg®️ and associated open source project names are trademarks of the Apache Software Foundation

On this page:
  • Create a connection
  • View details for a connection
  • List connections
  • Update a connection
  • Delete a connection
  • Related content