Assigning access rules for queries in Managed Service for Trino

1. Create a Terraform configuration file describing your infrastructure.

2. Add to the configuration file the yandex_trino_access_control resource containing the queries rule list.

   resource "yandex_trino_cluster" "<cluster_name>" {
     ...
   }
   
   resource "yandex_trino_access_control" "trino_access_control" {
     ...
     cluster_id  = yandex_trino_cluster.<cluster_name>.id
     queries = [
       # Rule 1
       {
         privileges    = ["<list_of_privileges>"]
         query_owners  = ["<list_of_query_owners>"]
         users         = ["<list_of_user_IDs>"]
         groups        = ["<list_of_group_IDs>"]
         description   = "<rule_description>"
       },
       # Rule 2
       {
         ... 
       },
       ...
       # Rule N
       {
         ... 
       }
     ]
     ...
   }
   

   Where:

   • queries: List of rule sections for queries. All the rule parameters are optional: privileges, query_owners, groups, users, and description.

   • privileges: List of permitted actions with queries:

     • VIEW: View query information.
     • KILL: Cancel a query.
     • EXECUTE: Run a query.

     If you do not specify the privileges parameter, the rule will prohibit any actions with the queries.

     Warning

     You cannot specify the EXECUTE privilege if the rule already contains the query_owners parameter.

   • query_owners: List of query owner IDs. The rule will apply to queries whose owners are listed in query_owners. If not specified, the rule will apply to queries from all users.

   • groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.

   • users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.

   • description: Rule description.

3. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

4. Confirm updating the resources.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

1. Get an IAM token for API authentication and put it in an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

3. Create a file named body.json and paste the following code into it:

   {
     <cluster_parameters>
     ...
     "trino": {
       "access_control": {
         "queries": [
           {
             "privileges": [
               "<list_of_privileges>"
             ],
             "query_owners": [
               "<list_of_query_owners>"
             ],
             "users": [
               "<list_of_user_IDs>"
             ],
             "groups": [
               "<list_of_group_IDs>"
             ],
             "description": "<rule_description>"
           },
           {
             <Rule_2_section>
           },
           ...
           {
             <Rule_N_section>
           }
         ]
       }
     }
   }
   

   Where:

   • access_control: Access rule configuration in the cluster.

   • queries: List of rule sections for queries. All the rule parameters are optional: privileges, query_owners, groups, users, and description.

   • privileges: List of permitted actions with queries:

     • VIEW: View query information.
     • KILL: Cancel a query.
     • EXECUTE: Run a query.

     If you do not specify the privileges parameter, the rule will prohibit any actions with the queries.

     Warning

     You cannot specify the EXECUTE privilege if the rule already contains the query_owners parameter.

   • query_owners: List of query owner IDs. The rule will apply to queries whose owners are listed in query_owners. If not specified, the rule will apply to queries from all users.

   • groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.

   • users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.

   • description: Rule description.

   For available cluster parameters and their descriptions, see this guide.

4. Call the ClusterService/Create method, e.g., via the following gRPCurl request:

   grpcurl \
       -format json \
       -import-path ~/cloudapi/ \
       -import-path ~/cloudapi/third_party/googleapis/ \
       -proto ~/cloudapi/yandex/cloud/trino/v1/cluster_service.proto \
       -rpc-header "Authorization: Bearer $IAM_TOKEN" \
       -d @ \
       trino.api.cloud.yandex.net:443 \
       yandex.cloud.trino.v1.ClusterService.Create \
       < body.json
   

5. Check the server response to make sure your request was successful.

1. Open the current Terraform configuration file describing your infrastructure.

   To learn how to create this file, see Creating a cluster.

2. If you have not set the access rules yet, add the yandex_trino_access_control resource containing the queries rule list.

   resource "yandex_trino_cluster" "<cluster_name>" {
     ...
   }
   
   resource "yandex_trino_access_control" "trino_access_control" {
     ...
     cluster_id  = yandex_trino_cluster.<cluster_name>.id
     queries = [
       # Rule 1
       {
         privileges    = ["<list_of_privileges>"]
         query_owners  = ["<list_of_query_owners>"]
         users         = ["<list_of_user_IDs>"]
         groups        = ["<list_of_group_IDs>"]
         description   = "<rule_description>"
       },
       # Rule 2
       {
         ... 
       },
       ...
       # Rule N
       {
         ... 
       }
     ]
     ...
   }
   

   Where:

   • queries: List of rule sections for queries. All the rule parameters are optional: privileges, query_owners, groups, users, and description.

   • privileges: List of permitted actions with queries:

     • VIEW: View query information.
     • KILL: Cancel a query.
     • EXECUTE: Run a query.

     If you do not specify the privileges parameter, the rule will prohibit any actions with the queries.

     Warning

     You cannot specify the EXECUTE privilege if the rule already contains the query_owners parameter.

   • query_owners: List of query owner IDs. The rule will apply to queries whose owners are listed in query_owners. If not specified, the rule will apply to queries from all users.

   • groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.

   • users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.

   • description: Rule description.

3. If you have already set the access rules, edit the yandex_trino_access_control resource description. You can:

   • Add new rules.
   • Update the existing ones.
   • Delete the rules you no longer need.

4. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

5. Confirm updating the resources.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

1. Get an IAM token for API authentication and put it in an environment variable:

   export IAM_TOKEN="<IAM_token>"
   

2. Clone the cloudapi repository:

   cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
   

   Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

3. If you have not set any access rules yet, create a file named body.json and paste the following code into it:

   {
     "cluster_id": "<cluster_ID>",
     "update_mask": {
       "paths": [
         "trino.access_control.queries"
       ]
     },
     "trino": {
       "access_control": {
         "queries": [
           {
             "privileges": [
               "<list_of_privileges>"
             ],
             "query_owners": [
               "<list_of_query_owners>"
             ],
             "users": [
               "<list_of_user_IDs>"
             ],
             "groups": [
               "<list_of_group_IDs>"
             ],
             "description": "<rule_description>"
           },
           {
             <Rule_2_section>
           },
           ...
           {
             <Rule_N_section>
           }
         ]
       }
     }
   }
   

   Where:

   • cluster_id: Cluster ID.

     You can get the cluster ID with the list of clusters in the folder.

   • update_mask: List of parameters to update as an array of strings (paths[]).

     Format for listing settings

     "update_mask": {
       "paths": [
         "<setting_1>",
         "<setting_2>",
         ...
         "<setting_N>"
       ]
     }
     

     Warning

     When you update a cluster, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the update_mask parameter.

   • access_control: Access rule configuration in the cluster.

   • queries: List of rule sections for queries. All the rule parameters are optional: privileges, query_owners, groups, users, and description.

   • privileges: List of permitted actions with queries:

     • VIEW: View query information.
     • KILL: Cancel a query.
     • EXECUTE: Run a query.

     If you do not specify the privileges parameter, the rule will prohibit any actions with the queries.

     Warning

     You cannot specify the EXECUTE privilege if the rule already contains the query_owners parameter.

   • query_owners: List of query owner IDs. The rule will apply to queries whose owners are listed in query_owners. If not specified, the rule will apply to queries from all users.

   • groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.

   • users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.

   • description: Rule description.

4. If you have already set the access rules, open the existing body.json rules file and edit it as needed. You can:

   • Add new rules.
   • Update the existing ones.
   • Delete the rules you no longer need.

5. Call the ClusterService.Update method, e.g., via the following gRPCurl request:

   grpcurl \
     -format json \
     -import-path ~/cloudapi/ \
     -import-path ~/cloudapi/third_party/googleapis/ \
     -proto ~/cloudapi/yandex/cloud/trino/v1/cluster_service.proto \
     -rpc-header "Authorization: Bearer $IAM_TOKEN" \
     -d @ \
     trino.api.cloud.yandex.net:443 \
     yandex.cloud.trino.v1.ClusterService.Update \
     < body.json
   

6. Check the server response to make sure your request was successful.

The configuration file for this rule set is as follows:

resource "yandex_trino_access_control" "trino_access_control" {
  ...
  cluster_id  = <cluster_ID>
  queries = [
    {
      privileges    = ["VIEW", "KILL", "EXECUTE"]
      groups        = ["admins_group_id"]
    },
    {
      privileges    = ["VIEW", "KILL"]
      groups        = ["security_group_id"]
      query_owners  = ["suspicious_user_id"]
    },
    {
      privileges    = ["EXECUTE"]
    }
  ]
  ...
}

The body.json file for this rule set is as follows:

{
  "cluster_id": "<cluster_ID>",
  "update_mask": {
    "paths": [
      "trino.access_control.queries"
    ]
  },
  "trino": {
    "access_control": {
      "queries": [
        {
          "privileges": [
            "VIEW",
            "KILL",
            "EXECUTE"              
          ],
          "groups": [
            "admins_group_id"
          ]
        },
        {
          "privileges": [
            "VIEW",
            "KILL"
          ],
          "query_owners": [
            "suspicious_user_id"
          ],
          "groups": [
            "security_group_id"
          ]
        },
        {
          "privileges": [
            "EXECUTE"
          ]
        }
      ]
    }
  }
}