Impersonation in Managed Service for Trino

Impersonation in Managed Service for Trino is when an Trino cluster performs actions with user resources on behalf of a service account.

By default, an Trino cluster does not have permissions to access user resources. To provide access to such resources, create a service account with the required roles and link it to the Trino cluster when creating or updating the cluster. With that done, the coordinator and workers will be able to authenticate as this service account. For example, Hive, Iceberg, and Delta Lake connectors authenticate in Object Storage as the cluster service account.

Impersonation enables an Trino cluster to support integration with other Yandex Cloud services. These include Yandex Cloud Logging, Yandex Monitoring, Yandex Connection Manager, and Yandex Object Storage.

For a cluster to be able to interface with the services, assign the following roles to its service account:

• managed-trino.integrationProvider: This role will allow the cluster to write logs to Cloud Logging or send metrics to Monitoring.
• connection-manager.user: For using connections from Connection Manager.
• lockbox.payloadViewer: For using Yandex Lockbox secrets.
• storage.editor: For interfacing with the Object Storage bucket.

Services available for integrationServices available for integration

Connection ManagerConnection Manager

Connection Manager is a service for managing parameters of connections to user database installations and secure password storage. If a Managed Service for Trino cluster folder indicates Connection Manager as connection type, the cluster service account gets connection parameters, such as network addresses, ports, encrypted username and password, by its ID in Connection Manager.

Cloud LoggingCloud Logging

Cloud Logging stores and reads logs collected by Yandex Cloud services. If logging is enabled in a Managed Service for Trino cluster, the cluster logs will be saved to the default log group of the selected folder or to the custom log group in Cloud Logging.

You can enable logging when creating or updating a cluster.

MonitoringMonitoring

Monitoring enables collecting and storing the metrics of Yandex Cloud services. Metrics are displayed as charts on the cluster page under Monitoring. They show the current state and health of the cluster. Metrics are available by default in all Managed Service for Trino clusters. For a list of available metrics, see the relevant reference.

Object StorageObject Storage

Object Storage is a service for data storage. To enable Yandex Managed Service for Trino to interface with an Object Storage bucket, you need a Apache Hive™ Metastore cluster. The service accounts associated with the Managed Service for Trino and Apache Hive™ Metastore clusters must be assigned the storage.editor role.