Connection Profiles
Connection Profiles store the credentials and endpoint for one external platform, so source and sink nodes authenticate without credentials being entered on each node.
Overview
A connection profile answers how Fleak authenticates against an external platform, and where that platform lives — a broker address, a workspace host, a region. It does not name the individual topic, queue, table, or folder you read from or write to. That is a Data Asset.
Together the three layers divide as follows:
| Layer | Answers | Example |
|---|---|---|
| Connection Profile | Which platform, and what credentials | An AWS access key pair plus us-east-1 |
| Data Asset | Which location on that platform | The queue https://sqs.us-east-1.amazonaws.com/123456789012/orders |
| Node | How the workflow reads or writes it | Batch size, flush interval, encoding |
One profile backs many assets, and one asset backs many workflows. Rotating a credential is a single edit on the profile rather than a change to every node that uses it.
Connection profiles replace what earlier versions of Fleak called Integrations. The settings page is now Settings → Connection Profiles.
Managing Connection Profiles
Accessing Connection Profiles
Click your username in the top left of the Fleak dashboard, select Settings, then
Connection Profiles in the settings sidebar (/settings/connection-profiles). Data Assets is a separate item directly in the main sidebar, not a Settings page.
Creating a Connection Profile
Click Add New, choose the platform in Add Connection Profile, then fill in the fields for that platform. Each platform's fields are listed in Supported Platforms below. Every profile also takes a name, which is what you select by when configuring a data asset or a node.
You can also create a profile without leaving the workflow builder, while configuring a node or a data asset. Most platforms support both routes. API Key profiles, which hold the Splunk HEC token, are the exception: they can only be created inline, while creating a data asset, and the settings page does not offer them.
Ownership and Sharing
A profile has a single owner, the person who created it. Sharing it with your organization makes it selectable by other members; leaving it unshared keeps it private to you.
Secrets are masked server-side for anyone who is not the owner. A non-owner sees a
profile's secret fields as •••••••• and cannot read the stored value back, whether
through the UI or the API. Non-secret configuration — a region, a host URL, a Datadog site
— stays visible, so a shared profile is still usable and auditable without exposing the
credential.
Editing and Re-deploying
Open the profile, then use Edit in its Configuration card (available to the profile owner) and Save. Profile fields control the platform connection; this changes the profile itself. To change an asset's profile association, use its separate Connection Profile → Edit card in Data Assets. Asset-owned target and property edits are described in Managing Data Assets.
Saving an edit to a profile does not change running deployments. Fleak warns you on save:
Changes won't apply until you re-deploy. Saving updates this connection profile, but running deployments keep using the previous settings until you re-deploy them.
Re-deploy each affected workflow for a credential rotation or endpoint change to take effect.
Deleting
A profile that data assets or workflows still reference cannot be deleted until those references are removed.
Supported Platforms
The platforms below back the connectors that are generally available. Accounts with additional connectors enabled see further platforms on the settings page; those are not generally available, and the ones documented here are under Platforms Not Generally Available.
| Platform | Used by |
|---|---|
| AWS | S3 Sink, File System Source, SQS Sink, SQS Source, S3 Event Notifications Source |
| Apache Kafka | Kafka Sink, Kafka Source |
| Databricks | Databricks Sink, Databricks Zerobus Sink |
| Datadog | Datadog Logs Sink |
| Microsoft Sentinel Workspace | Microsoft Sentinel Sink |
| Snowflake | Snowflake Sink |
| API Key | Splunk HEC Sink |
AWS S3
S3 assets use the shared AWS profile (type AWS), which also serves SQS assets.
| Field | Description | Required |
|---|---|---|
| Region | The default AWS region for this connection profile, e.g. us-east-1. For an S3 asset, the bucket region detected by Fleak takes precedence over this default; this field does not change the bucket's region. | Yes |
| AWS Access Key ID | The access key ID of the IAM user Fleak authenticates as. | Yes |
| AWS Secret Access Key | The matching secret access key. Stored encrypted and masked from non-owners. | Yes |
Required IAM permissions:
- Profile validation uses AWS STS and needs no S3 permission at all.
s3:ListBucketon the bucket ARN — required by S3 Folder source nodes (File System Source) to list objects.s3:GetObjecton the object or prefix ARN — required by S3 Folder source nodes (File System Source) to read objects.s3:PutObjecton the destination object or prefix ARN — required by S3 Folder sink nodes.s3:AbortMultipartUploadon the destination ARN — used by the default batch/multipart sink only to clean up a failed upload so incomplete parts do not remain billable. This is nots3:DeleteObject.s3:ListAllMyBucketson*— optional, used only for automatic bucket discovery. You can type a bucket name manually if this is denied.- For buckets or objects with default SSE-KMS encryption, grant
kms:Decryptfor reads,kms:GenerateDataKeyfor writes, and both for multipart writes, on the KMS key ARN. Fleak has no KMS field in this form.
AWS SQS
SQS assets use the same AWS profile (type AWS); AWS SQS is an asset family, not a separate profile type.
| Field | Description | Required |
|---|---|---|
| Region | The default AWS region for this connection profile, e.g. us-west-2. An SQS asset uses its own region, normally derived from its Queue URL or explicitly set on the asset; that asset region takes precedence over this default. | Yes |
| AWS Access Key ID | The access key ID of the IAM user Fleak authenticates as. | Yes |
| AWS Secret Access Key | The matching secret access key. | Yes |
Apache Kafka
| Field | Description | Required |
|---|---|---|
| Broker/Bootstrap Address | Comma-separated bootstrap servers, e.g. broker1:9092,broker2:9092. | Yes |
| Authentication Type | PLAINTEXT, SSL, SASL_PLAINTEXT, or SASL_SSL. Defaults to SASL_SSL. | Yes |
| SASL Mechanism | PLAIN, SCRAM-SHA-256, or SCRAM-SHA-512. Shown only for the SASL protocols. Defaults to PLAIN. | Yes, for SASL |
| Username | SASL username. | No |
| Password | SASL password. | No |
| Additional Connection Properties | Free-form Kafka client properties for anything the fields above do not cover, e.g. ssl.* or client.id. Found under Show advanced options. | No |
The authentication type and SASL mechanism are written into the profile's Kafka client
properties on save. Because the profile owns the security configuration, a node whose
connection comes from a profile cannot override security.protocol, sasl.mechanism,
sasl.jaas.config, or the SSL password properties on itself.
Databricks
| Field | Description | Required |
|---|---|---|
| Host URL | Your workspace URL, e.g. https://dbc-xxxx.cloud.databricks.com. | Yes |
| Client ID | The service principal's application ID. | Yes |
| Client Secret | The service principal's OAuth secret. | Yes |
| Zerobus Ingest Endpoint | Under + Show advanced options when creating the profile; used by Zerobus table assets. | Required for Zerobus writes; optional for other Databricks assets |
Use OAuth M2M (machine-to-machine) credentials from a Databricks service principal, not a personal access token. M2M tokens refresh automatically, which is what keeps a 24/7 pipeline authenticated.
Databricks Zerobus
Zerobus uses the shared Databricks profile (type DATABRICKS), not a separate profile type. Its Host URL, Client ID, and Client Secret authenticate to the workspace. Configure Zerobus Ingest Endpoint under + Show advanced options when creating a profile, or in Configuration → Edit on an existing profile. A profile without that endpoint can serve other Databricks assets, but cannot supply the endpoint required for Zerobus writes.
Datadog
| Field | Description | Required |
|---|---|---|
| Site | Your Datadog region domain — the host in your Datadog URL, e.g. us3.datadoghq.com. Enter the domain only, without https:// or a path. US1 accounts use datadoghq.com. | Yes |
| API Key | A Datadog API key from Organization Settings → API Keys. This is the API key, not an Application key. | Yes |
The site determines the intake endpoint, so it decides both where and how logs are delivered.
Microsoft Sentinel Workspace
Directory (Tenant) ID, Application (Client) ID, Client Secret, Log Analytics Workspace ID, and Azure Cloud (PUBLIC | US_GOV | CHINA) belong to the Microsoft Sentinel Workspace profile (type SENTINEL). Tenant ID is a profile setting, not an asset setting. A Sentinel DCR stream asset separately owns Data Collection Endpoint, Immutable DCR ID, and Stream Name. In Data Assets → Asset Information → Edit, existing Immutable Dcr Id and Stream Name properties can be changed with Save → Save Changes. Save rejects a changed Data Collection Endpoint even though its input is shown; use a replacement asset for another endpoint.
Snowflake
The Snowflake profile owns Account Identifier, Authentication Method, Username, the credential for that authentication method, and optional Role. Role is under + Show advanced options when creating a profile; on an existing profile use Configuration → Edit. The Snowflake data asset owns Database, Schema, Table, and Warehouse. Warehouse is not a profile setting, and Role is not an asset setting. Existing Database, Schema, and Warehouse property inputs can be changed in Data Assets → Asset Information → Edit, then Save → Save Changes. A missing property key cannot be added there. Save rejects a changed Table location even though its input is shown; use a replacement asset for another table.
API Key
A bare credential with no endpoint of its own — the data asset carries the endpoint. Used for the Splunk HEC token.
| Field | Description | Required |
|---|---|---|
| API Key | The token value, sent verbatim. | Yes |
API Key profiles are created inline only, while creating a data asset. In the asset wizard's connect step, for example Connect to Splunk for a Splunk HEC Endpoint, open Select a Connection Profile, choose + Add new connection profile, enter a Connection Name and the API Key, then Connect & Continue. The profile is saved together with the asset when you click Import. API Key is not a choice in Add Connection Profile on the settings page, and existing API Key profiles are not listed in Settings → Connection Profiles. Compatible assets offer them in Select a Connection Profile when creating the asset, marked (API key), and by name in the asset's Connection Profile → Edit card in Data Assets.
To open an existing API Key profile, open an asset that uses it in Data Assets and click the profile name in its Connection Profile card. The profile opens in Settings → Connection Profiles. Its owner can change the key with Edit in Configuration, then Save → Save Changes, and can delete the profile from More actions. Re-deploy affected workflows for a changed key to apply. To move an asset to a different API Key profile instead, the asset owner can use Connection Profile → Edit → Save → Save Changes.
A Splunk connection profile (Splunk URL, Validate SSL Certificates, Username, Password) is a different profile type. A Splunk HEC Endpoint asset cannot use it; the HEC token always lives on an API Key profile.
Platforms Not Generally Available
The platforms in this section back connectors that are not generally available. They appear in Add Connection Profile only for accounts where those connectors have been enabled. Each connector's own page states its availability.
| Platform | Used by |
|---|---|
| GCP | Pub/Sub Sink |
| Splunk Observability | SignalFx Sink |
| XSIAM | XSIAM Sink |
GCP
The GCP profile owns Project ID and authentication. A Pub/Sub asset owns its Topic, which is selected or entered during asset creation. Changing Project ID on the profile does not make the existing asset's Topic editable; use the replacement-asset flow to choose another topic.
Splunk Observability
A SignalFx ingest asset requires a Splunk Observability profile (type SIGNALFX), with Realm and Access Token. A generic API Key profile is not compatible. The asset creation form displays Realm read-only from the profile and stores it as the asset location; Default Dimensions belong to the asset. Edit Realm or Access Token on the profile. Existing dimension values can be changed in the asset's Asset Information → Edit card, but it has no add-key control. Its Realm input cannot save a changed realm. To switch the asset to another compatible profile, use Connection Profile → Edit → Save → Save Changes; the asset derives its Realm from that profile.
Related pages
- Data Assets — the locations these profiles authenticate against
- Workflow Lifecycle — when a re-deploy is required