Skip to main content
The Flink SQL workbench lets you write and run Flink SQL statements on Confluent Cloud compute pools from Console, browse the topics you can query and export results. It’s a preview feature: find it under Flink (with a PREVIEW badge) in the sidebar. Statements run in Confluent Cloud with your organization’s API key, so Console applies its own access control: before it submits a statement, Console checks that the user can run Flink on the compute pool and has the right permission on every topic the statement touches.
Flink statements bypass data masking policies: Console reads the results from Confluent Cloud and doesn’t mask them. Before you grant Flink access, check that your users are allowed to see the unmasked data in the topics they can query.

​
Prerequisites

1

Create a Global Cloud API key

In Confluent Cloud, create an API key and set Select key scope to Global.Console calls both the Confluent Cloud control plane (organization, environments, compute pools and Kafka clusters) and the regional Flink SQL endpoints with this key. Only a Global key authenticates on both: a key scoped to a single resource type, such as Flink region or Cloud resource management, doesn’t. The key’s principal also needs access to the environments, compute pools and topics your users will query in Confluent Cloud.The Confluent Cloud Create API key form with Select key scope set to Global
2

Register your Confluent Cloud organization

In Console, go to Settings > Confluent Cloud and click + Organization.Confluent Cloud Organizations settings page with no organization registeredFill in the form:
  • Display name: a label for this organization in Console.
  • Confluent Cloud Organization ID: the organization UUID, from your Confluent Cloud organization settings. You can’t change it after registration.
  • API key and API secret: the Global key from the previous step. Console stores the secret encrypted.
Click Test connection. Console confirms it reached Confluent Cloud and shows how many environments it found. Then click Add Confluent Cloud Organization.Add Confluent Cloud Organization form with a successful connection testTest connection only checks the organization and its environments. If statements later fail with Confluent Cloud denied access with these credentials, check that the key has the Global scope.
3

Give users access

Admins can run Flink on every compute pool. For other users and groups:
  1. Open the user or group, then the Resource access tab.
  2. Under Compute pools, click Add permissions and pick the organization, the environment and a compute pool (or All compute pools).
  3. Select Run Flink, then click Save changes. A user's Compute pools permissions with Run Flink on one compute pool
Users also need permissions on the topics they query: see topic permissions. To let a user register or edit Confluent organizations, grant Can manage confluent cloud organization in their Service access tab.Service access tab listing the Can manage confluent cloud organization permissionYou can’t grant Run Flink with the Console API or CLI yet: use the Console UI.

​
Run a statement

Go to Flink, click + New statement, then:
  1. Pick the Catalog (your Confluent Cloud environment) and the Compute pool. Check the compute pool before you run: Console preselects a default compute pool, which can be in a different region from the cluster you query.
  2. Write your statement. The Catalog panel lists the clusters and topics you can query, with the columns of each topic’s value schema.
  3. Pick the Result mode, then click Run.
Flink workbench with a SELECT statement, the catalog panel and Snapshot mode selected Name every table with its cluster: `<environment>`.`<cluster>`.`<topic>` or `<cluster>`.`<topic>`, where the cluster is its Confluent display name or its lkc- ID. For example:

​
Result modes

  • Streaming (default) shows rows as the statement produces them, until you click Stop. Switch between the Table view and the Changelog view, which adds the change type of each row.
  • Snapshot runs a bounded query on the current data and shows the result when it completes.
Snapshot results with 20 rows, the CSV button and the Completed status Streaming results in the Changelog view with the Stop button enabled Click CSV to export the rows shown in the workbench. The workbench keeps up to 2,000 rows in the Table view and 500 in the Changelog view, so the export can be incomplete for larger results: Console warns you when that’s the case. Leaving the workbench doesn’t stop a streaming statement: it keeps running in Confluent Cloud, and consuming compute pool resources, until you stop it.

​
Write and DDL statements

INSERT, CREATE TABLE, CREATE VIEW and DROP statements don’t return rows: the results pane shows No result set. CREATE TABLE creates the topic and its value schema in Confluent Cloud. An INSERT statement completed, with No result set in the results pane
  • CREATE TABLE AS and INSERT INTO ... SELECT keep running until you stop them, like any statement that reads a topic continuously. Check the status badge next to the statement name: the footer of the results pane can show Finished as soon as the statement is submitted, while the statement is still running.
  • DROP TABLE soft-deletes the Schema Registry subjects of the table. Delete them permanently in Schema Registry if you want to reuse the name with a different schema.
  • The output of SHOW CREATE TABLE can’t be run as is: it contains WITH options, such as connector or kafka.retention.time, that Console refuses. See statements Console refuses.

​
Manage statements

The Flink statements page lists the statements running in the selected organization and catalog, with their status, creation date, compute pool and account. You only see statements on compute pools where you have Run Flink, and only if you have every topic permission they require. Flink statements list with statement, status, created, compute pool and account columns The Account column shows the Confluent Cloud principal that owns the organization API key, for every statement submitted from Console, not the Console user who ran it. From the statement page or the … menu of the list:
  • Stop a running statement. You can’t resume it.
  • Delete a statement. This is permanent: type DELETE to confirm.

​
Topic permissions

Console parses each statement and checks the user’s topic permissions before it submits it to Confluent Cloud. In the Resource access tab, read is the Consume permission, write is Produce, create is Create and delete is Delete: If permissions are missing, Console lists them all, for example The user doesn't have the required permissions: "kafka.topics.write" on topic orders-cluster.orders. To let users create tables, grant Create on a topic prefix, such as team-a-*. This prefix doesn’t cover a topic named team-a. An INSERT statement refused because the user doesn't have the write permission on the target topic

​
Statements Console refuses

Console refuses statements when it can’t determine which topics they touch. The statement fails in Console and isn’t sent to Confluent Cloud: A statement refused because the table name doesn't name a cluster Console also doesn’t check that the compute pool and the cluster are in the same region: a cross-region statement fails in Confluent Cloud.