TechPrufer
Sign inGet started

Blogs›Confluent›Shared Services Security and Resource Management

Shared Services Security and Resource Management

Shared Services Security and Resource Management

4
posts
2020–2023

This release enhances Confluent Cloud's capabilities for building secure shared services platforms. It introduces Cluster Role-Based Access Control (RBAC) for granular management access to resources like production environments and sensitive clusters, complementing existing ACLs for application access to Kafka resources. Audit Logs are now generally available, enabled by default, to track user/application resource access for anomaly detection and bad actor identification, with logs available in Confluent Cloud. This post details the security features of Kafka and Confluent Platform, covering authentication (SASL, mTLS), authorization (ACLs, RBAC), and encryption (data in transit, secrets management). It provides configuration examples for Kafka brokers, ZooKeeper, and HTTP services, and explains how RBAC integrates with Confluent's Metadata Service for centralized authorization.

2023

Build a Secure Data Streaming Platform Across Shared Services

1/31/2023

Introduces OAuth support for centralized identity management, allowing integration with third-party identity providers for secure, token-based authentication. Expands RBAC to cover all Confluent Cloud resources, including Schema Registry, Connect, and ksqlDB, enabling granular permissions across users and applications. Implements Cloud Client Quotas to provide per-application ingress/egress throughput controls for shared services and multi-tenant deployments. Adds Cloud Service Quotas for platform-wide resource budgeting and notifications. Introduces audit logs for critical Kafka operations (authentication, authorization, organization actions). Adds AsyncAPI specification support for event-driven architectures. Enhances self-serve networking with Transit Gateway attachment provisioning. Adds Terraform support for Cluster Linking.

2021

Introducing Cluster Authorization Using RBAC, Audit Logs, and BYOK in Confluent Cloud

5/20/2021

Introduces Cluster Role-Based Access Control (RBAC) for managing user permissions at the organization, environment, and cluster levels, allowing for granular control over access to sensitive resources. Also introduces Audit Logs, enabled by default, which capture user/application resource access events in a Kafka topic for monitoring and analysis. Enhances Bring Your Own Key (BYOK) encryption by making it available in preview for Google Cloud Dedicated clusters, in addition to the existing AWS support.

2020

New Confluent Cloud Data Security Features

11/6/2020

This post details the general availability of Bring Your Own Key (BYOK) encryption for Confluent Cloud Dedicated clusters on AWS, allowing users to encrypt data at rest with their own KMS keys. It also introduces the preview of Audit Logs, which track user and application access to Kafka clusters and cluster management actions, with events captured in a Kafka topic. The post also announces the upcoming preview of Cluster RBAC, which will enable granular role-based access control for users at the organization, environment, and cluster levels.

Best Practices for a Secure Kafka Deployment

5/28/2020

This post details the security features of Apache Kafka and Confluent Platform, covering authentication mechanisms (SASL with PLAIN, SCRAM, GSSAPI, OAUTHBEARER; mTLS), authorization mechanisms (Kafka ACLs, Confluent Platform's centralized ACLs, Role-Based Access Control (RBAC) powered by Confluent's Metadata Service), and encryption for data in transit (SSL/TLS). It provides configuration examples for Kafka brokers, ZooKeeper, and HTTP-based services (Kafka Connect, Schema Registry, REST Proxy, ksqlDB, Control Center). The post emphasizes the importance of securing these components for enterprise production environments and highlights the benefits of RBAC for managing access across multiple Kafka clusters and services.