Contact UsTry it for free
© 2026 Direct Cursus Technology L.L.C.

Assigning access rules for queries in Managed Service for Trino

Written by
Updated at March 17, 2026

Query access rules define the actions users can perform with SQL queries in a Managed Service for Trino cluster.

For each user-query pair, the rules apply as follows:

  • Rules are checked for matches in the order they are specified in the configuration file. The first rule matching the user-query pair applies.
  • If none of the rules match the user-query pair, no actions with the query are allowed to the user.
  • If no query access rules are set, any user can perform any actions with any query.
  • Query access rules apply together with the top-level rules for catalog objects.

Warning

If there are no query access rules, users can view and cancel each other's queries.

Setting rules when creating a cluster

You can set query access rules when creating a Managed Service for Trino cluster.

  1. In the management console, select the folder where you want to create a Managed Service for Trino cluster.

  2. Go to Managed Service for Trino.

  3. Click Create cluster and set the cluster parameters.

  4. Under Access settings, click .

  5. In the Queries field, click Add rule.

  6. In the window that opens, set the rule settings:

    1. Optionally, provide a rule description in the Comment field.

    2. Optionally, in the Users field, select the users the rule applies to:

      1. Click Add.
      2. Select the users from the list that opens. Use the search bar above the list to find particular users.
      3. To deselect a user selected by mistake, click that user again in the list.

      If no user is selected, the rule applies to all users.

    3. Optionally, in the Groups field, select the user groups the rule applies to:

      1. Click Add.
      2. From the list that opens, select the groups. Use the search bar above the list to find particular groups.
      3. To delete a group selected by mistake, click it again in the list.

      If you select no groups, the rule applies to all user groups.

    4. Optionally, in the Privileges field, select permitted actions with the queries:

      • VIEW: View query information.
      • KILL: Cancel a query.
      • EXECUTE: Run a query.

      If you do not select any actions, the rule prohibits any actions with the queries.

      Warning

      You cannot create a rule with the EXECUTE action permitted if at least one user is selected in the Query owners field.

    5. Optionally, in the Query owners field, select the users whose queries the rule applies to:

      1. Click Add.
      2. Select the users from the list that opens. Use the search bar above the list to find particular users.
      3. To deselect a user selected by mistake, click that user again in the list.

      I no user is selected in the Query owners field, the rule will apply to queries of all users.

  7. Add other rules in a similar way if required.

  8. To delete a rule added by mistake, click in the line with this rule.

  9. Click Create.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id options.

To set query access rules:

  1. Create a file named access_control.yaml and paste the following code into it:

    queries:
  # Rule 1
  - privileges: [<list_of_privileges>]
    query_owners: [<list_of_query_owners>]
    groups: [<list_of_group_IDs>]
    users: [<list_of_user_IDs>]
    description: <rule_description>
  # Rule 2
  - <Rule_2_parameters>
  ...
  # Rule N
  - <Rule_N_parameters>

    Where:

    • queries: List of query rules. All the rule parameters are optional: privileges, query_owners, groups, users, and description.

    • privileges: List of permitted actions with queries:

      • VIEW: View query information.
      • KILL: Cancel a query.
      • EXECUTE: Run a query.

      If you do not specify the privileges parameter, the rule will prohibit any actions with the queries.

      Warning

      You cannot specify the EXECUTE privilege if the rule already contains the query_owners parameter.

    • query_owners: List of query owner IDs. The rule will apply to queries whose owners are listed in query_owners. If not specified, the rule will apply to queries from all users.

    • groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.

    • users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.

    • description: Rule description.

  2. View the description of the CLI command for creating a cluster:

    yc managed-trino cluster create --help

  3. Run this command:

    yc managed-trino cluster create \
  ...
  --access-control-from-file access_control.yaml

    For available cluster parameters and their descriptions, see this guide.

  1. Create a Terraform configuration file describing your infrastructure.

  2. Add the yandex_trino_access_control resource with the queries rule list to the configuration file.

    resource "yandex_trino_cluster" "<cluster_name>" {
  ...
}

resource "yandex_trino_access_control" "trino_access_control" {
  ...
  cluster_id  = yandex_trino_cluster.<cluster_name>.id
  queries = [
    # Rule 1
    {
      privileges    = ["<list_of_privileges>"]
      query_owners  = ["<list_of_query_owners>"]
      users         = ["<list_of_user_IDs>"]
      groups        = ["<list_of_group_IDs>"]
      description   = "<rule_description>"
    },
    # Rule 2
    {
      ... 
    },
    ...
    # Rule N
    {
      ... 
    }
  ]
  ...
}

    Where:

    • queries: List of rule sections for queries. All the rule parameters are optional: privileges, query_owners, groups, users, and description.

    • privileges: List of permitted actions with queries:

      • VIEW: View query information.
      • KILL: Cancel a query.
      • EXECUTE: Run a query.

      If you do not specify the privileges parameter, the rule will prohibit any actions with the queries.

      Warning

      You cannot specify the EXECUTE privilege if the rule already contains the query_owners parameter.

    • query_owners: List of query owner IDs. The rule will apply to queries whose owners are listed in query_owners. If not specified, the rule will apply to queries from all users.

    • groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.

    • users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.

    • description: Rule description.

  3. Make sure the settings are correct.

    1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

    2. Run this command:

      terraform validate

      Terraform will show any errors found in your configuration files.

  4. Confirm updating the resources.

    1. Run this command to view the planned changes:

      terraform plan

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

    2. If everything looks correct, apply the changes:

      1. Run this command:

        terraform apply

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

  1. Get an IAM token for API authentication and put it in an environment variable:

    export IAM_TOKEN="<IAM_token>"

  2. Clone the cloudapi repository:

    cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi

    Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

  3. Create a file named body.json and paste the following code into it:

    {
  <cluster_parameters>
  ...
  "trino": {
    "access_control": {
      "queries": [
        {
          "privileges": [
            "<list_of_privileges>"
          ],
          "query_owners": [
            "<list_of_query_owners>"
          ],
          "users": [
            "<list_of_user_IDs>"
          ],
          "groups": [
            "<list_of_group_IDs>"
          ],
          "description": "<rule_description>"
        },
        {
          <Rule_2_section>
        },
        ...
        {
          <Rule_N_section>
        }
      ]
    }
  }
}

    Where:

    • access_control: Access rule configuration in the cluster.

    • queries: List of rule sections for queries. All the rule parameters are optional: privileges, query_owners, groups, users, and description.

    • privileges: List of permitted actions with queries:

      • VIEW: View query information.
      • KILL: Cancel a query.
      • EXECUTE: Run a query.

      If you do not specify the privileges parameter, the rule will prohibit any actions with the queries.

      Warning

      You cannot specify the EXECUTE privilege if the rule already contains the query_owners parameter.

    • query_owners: List of query owner IDs. The rule will apply to queries whose owners are listed in query_owners. If not specified, the rule will apply to queries from all users.

    • groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.

    • users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.

    • description: Rule description.

    For available cluster parameters and their descriptions, see this guide.

  4. Call the ClusterService/Create method, e.g., via the following gRPCurl request:

    grpcurl \
    -format json \
    -import-path ~/cloudapi/ \
    -import-path ~/cloudapi/third_party/googleapis/ \
    -proto ~/cloudapi/yandex/cloud/trino/v1/cluster_service.proto \
    -rpc-header "Authorization: Bearer $IAM_TOKEN" \
    -d @ \
    trino.api.cloud.yandex.net:443 \
    yandex.cloud.trino.v1.ClusterService.Create \
    < body.json

  5. Check the server response to make sure your request was successful.

Setting rules for an existing cluster

You can set or update query access rules in an existing Managed Service for Trino cluster.

  1. In the management console, navigate to the relevant folder.

  2. Go to Managed Service for Trino.

  3. Click the name of your cluster.

  4. Go to Access settings → Queries.

  5. To add a rule, click Add rule. In the window that opens, set the rule settings:

    1. Optionally, provide a rule description in the Comment field.

    2. Optionally, in the Users field, select the users the rule applies to:

      1. Click Add.
      2. Select the users from the list that opens. Use the search bar above the list to find particular users.
      3. To deselect a user selected by mistake, click that user again in the list.

      If no user is selected, the rule applies to all users.

    3. Optionally, in the Groups field, select the user groups the rule applies to:

      1. Click Add.
      2. From the list that opens, select the groups. Use the search bar above the list to find particular groups.
      3. To delete a group selected by mistake, click it again in the list.

      If you select no groups, the rule applies to all user groups.

    4. Optionally, in the Privileges field, select permitted actions with the queries:

      • VIEW: View query information.
      • KILL: Cancel a query.
      • EXECUTE: Run a query.

      If you do not select any actions, the rule prohibits any actions with the queries.

      Warning

      You cannot create a rule with the EXECUTE action permitted if at least one user is selected in the Query owners field.

    5. Optionally, in the Query owners field, select the users whose queries the rule applies to:

      1. Click Add.
      2. Select the users from the list that opens. Use the search bar above the list to find particular users.
      3. To deselect a user selected by mistake, click that user again in the list.

      I no user is selected in the Query owners field, the rule will apply to queries of all users.

  6. Add other rules in a similar way if required.

  7. To edit a rule:

    1. Click in the line with this rule.
    2. Update the rule settings and click Update.

  8. To delete a rule you no longer need, Click in the line with this rule.

  9. Click Save changes.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id options.

To set query access rules:

  1. If you have not set any access rules yet, create a file named access_control.yaml and paste the following into it:

    queries:
  # Rule 1
  - privileges: [<list_of_privileges>]
    query_owners: [<list_of_query_owners>]
    groups: [<list_of_group_IDs>]
    users: [<list_of_user_IDs>]
    description: <rule_description>
  # Rule 2
  - <Rule_2_parameters>
  ...
  # Rule N
  - <Rule_N_parameters>

    Where:

    • queries: List of query rules. All the rule parameters are optional: privileges, query_owners, groups, users, and description.

    • privileges: List of permitted actions with queries:

      • VIEW: View query information.
      • KILL: Cancel a query.
      • EXECUTE: Run a query.

      If you do not specify the privileges parameter, the rule will prohibit any actions with the queries.

      Warning

      You cannot specify the EXECUTE privilege if the rule already contains the query_owners parameter.

    • query_owners: List of query owner IDs. The rule will apply to queries whose owners are listed in query_owners. If not specified, the rule will apply to queries from all users.

    • groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.

    • users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.

    • description: Rule description.

  2. If you have already set the access rules, open access_control.yaml and edit it as needed. You can:

    • Add new rules.
    • Update the existing ones.
    • Delete the rules you no longer need.

  3. Run this command:

    yc managed-trino cluster set-access-control <cluster_name_or_ID> \
  --from-file access_control.yaml

    You can get the cluster ID and name with the list of clusters in the folder.

  1. Open the current Terraform configuration file describing your infrastructure.

    To learn how to create this file, see Creating a cluster.

  2. If you have not set any access rules yet, add the yandex_trino_access_control resource containing the queries rule list.

    resource "yandex_trino_cluster" "<cluster_name>" {
  ...
}

resource "yandex_trino_access_control" "trino_access_control" {
  ...
  cluster_id  = yandex_trino_cluster.<cluster_name>.id
  queries = [
    # Rule 1
    {
      privileges    = ["<list_of_privileges>"]
      query_owners  = ["<list_of_query_owners>"]
      users         = ["<list_of_user_IDs>"]
      groups        = ["<list_of_group_IDs>"]
      description   = "<rule_description>"
    },
    # Rule 2
    {
      ... 
    },
    ...
    # Rule N
    {
      ... 
    }
  ]
  ...
}

    Where:

    • queries: List of rule sections for queries. All the rule parameters are optional: privileges, query_owners, groups, users, and description.

    • privileges: List of permitted actions with queries:

      • VIEW: View query information.
      • KILL: Cancel a query.
      • EXECUTE: Run a query.

      If you do not specify the privileges parameter, the rule will prohibit any actions with the queries.

      Warning

      You cannot specify the EXECUTE privilege if the rule already contains the query_owners parameter.

    • query_owners: List of query owner IDs. The rule will apply to queries whose owners are listed in query_owners. If not specified, the rule will apply to queries from all users.

    • groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.

    • users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.

    • description: Rule description.

  3. If you have already set the access rules, edit the yandex_trino_access_control resource description. You can:

    • Add new rules.
    • Update the existing ones.
    • Delete the rules you no longer need.

  4. Make sure the settings are correct.

    1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

    2. Run this command:

      terraform validate

      Terraform will show any errors found in your configuration files.

  5. Confirm updating the resources.

    1. Run this command to view the planned changes:

      terraform plan

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

    2. If everything looks correct, apply the changes:

      1. Run this command:

        terraform apply

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

  1. Get an IAM token for API authentication and place it in an environment variable:

    export IAM_TOKEN="<IAM_token>"

  2. Clone the cloudapi repository:

    cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi

    Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

  3. If you have not set any access rules yet, create a file named body.json and paste the following code into it:

    {
  "cluster_id": "<cluster_ID>",
  "update_mask": {
    "paths": [
      "trino.access_control.queries"
    ]
  },
  "trino": {
    "access_control": {
      "queries": [
        {
          "privileges": [
            "<list_of_privileges>"
          ],
          "query_owners": [
            "<list_of_query_owners>"
          ],
          "users": [
            "<list_of_user_IDs>"
          ],
          "groups": [
            "<list_of_group_IDs>"
          ],
          "description": "<rule_description>"
        },
        {
          <Rule_2_section>
        },
        ...
        {
          <Rule_N_section>
        }
      ]
    }
  }
}

    Where:

    • cluster_id: Cluster ID.

      You can get the cluster ID with the list of clusters in the folder.

    • update_mask: List of parameters to update as an array of strings (paths[]).

      Format for listing settings
      "update_mask": {
  "paths": [
    "<setting_1>",
    "<setting_2>",
    ...
    "<setting_N>"
  ]
}

      Warning

      When you update a cluster, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the update_mask parameter.

    • access_control: Access rule configuration in the cluster.

    • queries: List of rule sections for queries. All the rule parameters are optional: privileges, query_owners, groups, users, and description.

    • privileges: List of permitted actions with queries:

      • VIEW: View query information.
      • KILL: Cancel a query.
      • EXECUTE: Run a query.

      If you do not specify the privileges parameter, the rule will prohibit any actions with the queries.

      Warning

      You cannot specify the EXECUTE privilege if the rule already contains the query_owners parameter.

    • query_owners: List of query owner IDs. The rule will apply to queries whose owners are listed in query_owners. If not specified, the rule will apply to queries from all users.

    • groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.

    • users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.

    • description: Rule description.

  4. If you have already set the access rules, open body.json with these rules and edit it as needed. You can:

    • Add new rules.
    • Update the existing ones.
    • Delete the rules you no longer need.

  5. Call the ClusterService.Update method, e.g., via the following gRPCurl request:

    grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/trino/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d @ \
  trino.api.cloud.yandex.net:443 \
  yandex.cloud.trino.v1.ClusterService.Update \
  < body.json

  6. Check the server response to make sure your request was successful.

Example of setting query access rules

Let's configure query access rules as follows:

  1. Allow any actions on queries to the user group with the admins_group_id.
  2. Allow the user group with the security_group_id to view and delete queries owned by user with the suspicious_user_id.
  3. Allow all other users to only run queries.

The access_control.yaml file for this rule set is as follows:

queries:
  - groups:
      - admins_group_id
    privileges:
      - VIEW
      - KILL
      - EXECUTE

  - groups: 
      - security_group_id
    query_owners:
      - suspicious_user_id
    privileges:
      - VIEW
      - KILL

  - privileges:
      - EXECUTE

The configuration file for this rule set is as follows:

resource "yandex_trino_access_control" "trino_access_control" {
  ...
  cluster_id  = <cluster_ID>
  queries = [
    {
      privileges    = ["VIEW", "KILL", "EXECUTE"]
      groups        = ["admins_group_id"]
    },
    {
      privileges    = ["VIEW", "KILL"]
      groups        = ["security_group_id"]
      query_owners  = ["suspicious_user_id"]
    },
    {
      privileges    = ["EXECUTE"]
    }
  ]
  ...
}

The body.json file for this rule set is as follows:

{
  "cluster_id": "<cluster_ID>",
  "update_mask": {
    "paths": [
      "trino.access_control.queries"
    ]
  },
  "trino": {
    "access_control": {
      "queries": [
        {
          "privileges": [
            "VIEW",
            "KILL",
            "EXECUTE"              
          ],
          "groups": [
            "admins_group_id"
          ]
        },
        {
          "privileges": [
            "VIEW",
            "KILL"
          ],
          "query_owners": [
            "suspicious_user_id"
          ],
          "groups": [
            "security_group_id"
          ]
        },
        {
          "privileges": [
            "EXECUTE"
          ]
        }
      ]
    }
  }
}
Previous
Assigning rules for procedures
Next
Assigning rules for system session properties