This document provides some common troubleshooting tips for
Confluent Cloud import topics.

After you configure the import topic and start ingesting messages, you can
check the relevant Cloud Monitoring metrics to see
if data is ingested. Perform the following steps:

1. In the console, go to the **Topics** page.

   [Go to Topics](https://console.cloud.google.com/cloudpubsub/topic/list)
2. Click the Confluent Cloud import topic that you want to troubleshoot.

3. In the topic details page, click the **Metrics** tab.

4. Check the chart for the metric **Ingestion byte count**.

5. If no data is being ingested, in the topic details page,
   check to see if there is an error for the
   **Topic state** field.

6. You can also check the metric **Ingestion data source state** .
   To do so, in the topic details page, click the **Metrics** tab.

7. Here is a list of errors that you might encounter:

   | Error Code | Description | Fix |
   |---|---|---|
   | `CONFLUENT_CLOUD_PERMISSION_DENIED` | Error consuming data from Confluent Cloud due to permission issues. | Verify the [identity provider](https://docs.cloud.google.com/pubsub/docs/create-confluent-cloud-import-topic.md.txt#create_id) has been correctly configured and the [identity pool has been given the appropriate roles.](https://docs.cloud.google.com/pubsub/docs/create-confluent-cloud-import-topic.md.txt#create_an_identity_pool_and_grant_the_appropriate_roles_in_confluent_cloud) |
   | `CONFLUENT_CLOUD_PERMISSION_DENIED` | Error consuming data from Confluent Cloud due to permission issues. | Verify that the Pub/Sub service account has the `iam.serviceAccounts.getOpenIdToken` permission. For more information, see [Add the Service Account Token Creator role to the Pub/Sub service account.](https://docs.cloud.google.com/pubsub/docs/create-confluent-cloud-import-topic.md.txt#add-service-account-token-creator) |
   | `CONFLUENT_CLOUD_PERMISSION_DENIED` | Error consuming data from Confluent Cloud due to permission issues. | Verify that you have added the service account user role to the service account. For more information, see [Add the service account user role to the service account.](https://docs.cloud.google.com/pubsub/docs/create-confluent-cloud-import-topic.md.txt#add-service-account-role) |
   | `PUBLISH_PERMISSION_DENIED` | Error publishing to the topic due to permission issues. | Grant the Pub/Sub service account the [necessary publish permissions](https://docs.cloud.google.com/pubsub/docs/access-control.md.txt#pubsub.publisher). For more information, see [Add the Pub/Sub publisher role to the Pub/Sub service account.](https://docs.cloud.google.com/pubsub/docs/create-confluent-cloud-import-topic.md.txt#add-publisher-role) |
   | `UNREACHABLE_BOOTSTRAP_SERVER` | The provided bootstrap server address is unreachable. | Verify the bootstrap server address for accuracy and ensure that the server is publicly accessible. |
   | `CLUSTER_NOT_FOUND` | The provided cluster wasn't found. | Verify the cluster ID for accuracy. Ensure that the cluster exists. |
   | `TOPIC_NOT_FOUND` | The provided Kafka topic wasn't found. | Verify the Kafka topic name for accuracy. Ensure that the topic exists within the specified cluster. |

If there are no errors till this point, check the best practices in
[Maintain a healthy publisher](https://docs.cloud.google.com/pubsub/docs/monitoring.md.txt#keeping_publishers_healthy).

You can also enable [platform logs](https://docs.cloud.google.com/pubsub/docs/platform-logs-pubsub.md.txt) for an
import topic. These logs help you troubleshoot issues
when you have issues ingesting objects into Pub/Sub import topics.
*Apache Kafka® is a registered
trademark of The Apache Software Foundation or its affiliates in the United
States and/or other countries.*