Back up Confluent Cloud to your own storage

Who backs up your data on a managed service​

Confluent Cloud is fully managed: Confluent operates the brokers and keeps them durable and available. That covers infrastructure failure. It does not cover the failures that a backup exists for — a bad deploy that poisons a topic, an accidental delete, or a poison record you need to roll back. Those are your data and your responsibility. A logical, point-in-time copy in a bucket you control closes that gap. See the disaster recovery use cases for the failure modes a backup covers.

Because Confluent Cloud speaks the standard Kafka protocol, OSO Kafka Backup needs no Confluent-specific integration. It connects over the public bootstrap endpoint as an ordinary client and reads your topics the same way it does on any other cluster.

Connecting to Confluent Cloud​

Confluent Cloud authenticates clients with an API key and secret over SASL_SSL using the PLAIN mechanism — the API key is the username, the secret is the password. Every key below comes from the configuration reference, and credentials resolve through environment variable substitution.

mode: backup
backup_id: cc-prod-daily

source:
bootstrap_servers:
  - pkc-abcde.us-east-1.aws.confluent.cloud:9092
security:
  security_protocol: SASL_SSL
  sasl_mechanism: PLAIN
  sasl_username: ${CC_API_KEY}
  sasl_password: ${CC_API_SECRET}

storage:
backend: s3
bucket: my-kafka-backups
region: us-east-1
prefix: confluent-cloud/production

backup:
compression: zstd
include_offset_headers: true

mode: restore
backup_id: cc-prod-daily

target:
bootstrap_servers:
  - pkc-abcde.us-east-1.aws.confluent.cloud:9092
security:
  security_protocol: SASL_SSL
  sasl_mechanism: PLAIN
  sasl_username: ${CC_API_KEY}
  sasl_password: ${CC_API_SECRET}

storage:
backend: s3
bucket: my-kafka-backups
region: us-east-1
prefix: confluent-cloud/production

kafka-backup backup --config confluent-cloud-backup.yaml

What gets backed up​

Every backup captures topic records with their timestamps and headers, consumer group offsets, and topic configuration, compressed with Zstd or LZ4. Restores can target the original Confluent Cloud cluster or a different one — including a self-managed cluster on another distribution — with topic and partition remapping, so backup and restore doubles as a migration path on or off Confluent Cloud.

Backing up the Confluent Schema Registry alongside topic data is an OSO Enterprise capability. The open source tool captures topic records, offsets, and configuration.