Assigning access rules for schemas in Managed Service for Trino

Written by

Updated at January 29, 2026

Setting rules when creating a cluster
Setting rules for an existing cluster
Example of setting schema access rules

Schema access rules decide which users own which schemas in a Managed Service for Trino cluster.

Note

The schema owner can create, update, or delete the schema. To do this, the owner needs the ALL access level for the catalog that contains the schema.

For each user-schema pair, the rules apply as follows:

Rules are checked for matches in the order they are specified in the configuration file. The first rule matching the user-schema pair applies.
If none of the rules match the user-schema pair, the user is not the schema owner.
If no schema access rules are set, each user owns all schemas in all catalogs.

Setting rules when creating a cluster

You can set schema access rules when creating a Managed Service for Trino cluster.

Warning

Schema names specified in the rules are not validated. If a schema name contains an error, the rule will not apply correctly.

CLI

Terraform

gRPC API

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

By default, the CLI uses the folder specified when creating the profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id parameter.

To set schema access rules:

Create a file named access_control.yaml and paste the following code into it:
```
schemas:
  # Rule 1
  - owner: <whether_or_not_user_owns_schema>
    schema:
      names:
        any: [<list_of_schema_names>]
      name_regexp: <regular_expression>
    catalog:
      name_regexp: <regular_expression>
    groups: [<list_of_group_IDs>]
    users: [<list_of_user_IDs>]
    description: <rule_description>
  # Rule 2
  - <Rule_2_parameters>
  ...
  # Rule N
  - <Rule_N_parameters>
```
Where:
- schemas: List of schema rules. Each rule contains the required owner parameter, as well as the optional schema, catalog, groups, users, and description parameters.
- owner: Whether or not the user owns the schema:
  - YES: This user owns the schema.
  - NO: This user does not own the schema.
- schema: Schemas the rule applies to. If you do not specify schema, the rule applies to all schemas.
  - names: List of schema names.
  - name_regexp: Regular expression. The rule applies to the schemas whose names match the regular expression.
  You can specify either names or name_regexp but not both.
- catalog: Cluster catalogs the rule applies to. If you do not specify catalog, the rule applies to all cluster catalogs.
  - name_regexp: Regular expression. The rule applies to the catalogs whose names match the regular expression.
- groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.
- users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.
- description: Rule description.
View the description of the CLI command for creating a cluster:
```
yc managed-trino cluster create --help
```

Run this command:

yc managed-trino cluster create \
  ...
  --access-control-from-file access_control.yaml

For available cluster parameters and their descriptions, see this guide.

Create a Terraform configuration file describing your infrastructure.
Add to the configuration file the yandex_trino_access_control resource containing the schemas rule list.
```
resource "yandex_trino_cluster" "<cluster_name>" {
  ...
}

resource "yandex_trino_catalog" "<catalog_1_name>" {
  ...
}

resource "yandex_trino_catalog" "<catalog_2_name>" {
  ...
}

...

resource "yandex_trino_catalog" "<catalog_N_name>" {
  ...
}

resource "yandex_trino_access_control" "trino_access_control" {
  ...
  cluster_id  = yandex_trino_cluster.<cluster_name>.id
  schemas = [
    # Rule 1
    {
      owner         = "<whether_or_not_user_owns_schema>"
      schema        = {
        names       = ["<list_of_schema_names>"]
        name_regexp = "<regular_expression>"
      }
      catalog       = {
        ids         = [
          yandex_trino_catalog.<catalog_1_name>.id,
          yandex_trino_catalog.<catalog_2_name>.id,
          ... 
          yandex_trino_catalog.<catalog_N_name>.id
        ]
        name_regexp = "<regular_expression>"
      }
      users         = ["<list_of_user_IDs>"]
      groups        = ["<list_of_group_IDs>"]
      description   = "<rule_description>"
    },
    # Rule 2
    {
      ... 
    },
    ...
    # Rule N
    {
      ... 
    }
  ]
  ...
}
```
Where:
- schemas: List of schema rule sections. Each rule contains the required owner parameter, as well as the optional schema, catalog, groups, users, and description parameters.
- owner: Whether or not the user owns the schema:
  - YES: This user owns the schema.
  - NO: This user does not own the schema.
- schema: Schemas the rule applies to. If the schema section is not specified, the rule applies to all schemas.
  - names: List of schema names.
  - name_regexp: Regular expression. The rule applies to the schemas whose names match the regular expression.
  You can specify either names or name_regexp but not both.
- catalog: Catalogs the rule applies to. If the catalog section is not specified, the rule applies to all cluster catalogs.
  - ids: List of catalog IDs. These catalogs must be created in the same manifest.
  - name_regexp: Regular expression. The rule applies to the catalogs whose names match the regular expression.
  You can specify either ids or name_regexp but not both.
- groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.
- users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.
- description: Rule description.
Make sure the settings are correct.
1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
2. Run this command:
```
terraform validate
```
  Terraform will show any errors found in your configuration files.
Confirm updating the resources.
1. Run this command to view the planned changes:
```
terraform plan
```
  If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
2. If everything looks correct, apply the changes:
  1. Run this command:
```
terraform apply
```
  2. Confirm updating the resources.
  3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

Get an IAM token for API authentication and put it in an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Clone the cloudapi repository:
```
cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
```
Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

Create a file named body.json and paste the following code into it:

{
  <cluster_parameters>
  ...
  "trino": {
    "catalogs": [
      {
        "name": "catalog_1_name",
        ...
      },
      {
        "name": "catalog_2_name",
        ...
      },
      ...
      {
        "name": "catalog_N_name",
        ...
      }
    ]
    ...
    "access_control": {
      "schemas": [
        {
          "owner": "<whether_or_not_user_owns_schema>",
          "schema": {
            "names": {
              "any": [
                "<list_of_schema_names>"
              ]
            },
            "name_regexp": "<regular_expression>"
          },
          "catalog": {
            "names": {
              "any": [
                "<catalog_1_name>",
                "<catalog_2_name>",
                ...
                "<catalog_N_name>"
              ]
            },
            "name_regexp": "<regular_expression>"
          },
          "users": [
            "<list_of_user_IDs>"
          ],
          "groups": [
            "<list_of_group_IDs>"
          ],
          "description": "<rule_description>"
        },
        {
          <Rule_2_section>
        },
        ...
        {
          <Rule_N_section>
        }
      ]
    }
  }
}

Where:

access_control: Access rule configuration in the cluster.
schemas: List of schema rule sections. Each rule contains the required owner parameter, as well as the optional schema, catalog, groups, users, and description parameters.
owner: Whether or not the user owns the schema:
- YES: This user owns the schema.
- NO: This user does not own the schema.
schema: Schemas the rule applies to. If the schema section is not specified, the rule applies to all schemas.
- names: List of schema names.
- name_regexp: Regular expression. The rule applies to the schemas whose names match the regular expression.
The schema section must contain either the nested names section or the name_regexp parameter.
catalog: Catalogs the rule applies to. If the catalog section is not specified, the rule applies to all cluster catalogs.
- names: List of catalog names. You must create catalogs within the same ClusterService/Create call.
- name_regexp: Regular expression. The rule applies to the catalogs whose names match the regular expression.
The catalog section must contain either the nested names section or the name_regexp parameter.

groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.
users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.
description: Rule description.

For available cluster parameters and their descriptions, see this guide.

Call the ClusterService/Create method, e.g., via the following gRPCurl request:

grpcurl \
    -format json \
    -import-path ~/cloudapi/ \
    -import-path ~/cloudapi/third_party/googleapis/ \
    -proto ~/cloudapi/yandex/cloud/trino/v1/cluster_service.proto \
    -rpc-header "Authorization: Bearer $IAM_TOKEN" \
    -d @ \
    trino.api.cloud.yandex.net:443 \
    yandex.cloud.trino.v1.ClusterService.Create \
    < body.json

Check the server response to make sure your request was successful.

Setting rules for an existing cluster

You can set or update schema access rules for an existing Managed Service for Trino cluster.

Warning

Schema names specified in the rules are not validated. If a schema name contains an error, the rule will not apply correctly.

CLI

Terraform

gRPC API

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

To set schema access rules:

If you have not set any access rules yet, create a file named access_control.yaml and paste the following code into it:
```
schemas:
  # Rule 1
  - owner: <whether_or_not_user_owns_schema>
    schema:
      names:
        any: [<list_of_schema_names>]
      name_regexp: <regular_expression>
    catalog:
      ids:
        any: [<list_of_catalog_IDs>]
      names:
        any: [<list_of_catalog_names>]
      name_regexp: <regular_expression>
    groups: [<list_of_group_IDs>]
    users: [<list_of_user_IDs>]
    description: <rule_description>
  # Rule 2
  - <Rule_2_parameters>
  ...
  # Rule N
  - <Rule_N_parameters>
```
Where:
- schemas: List of schema rules. Each rule contains the required owner parameter, as well as the optional schema, catalog, groups, users, and description parameters.
- owner: Whether or not the user owns the schema:
  - YES: This user owns the schema.
  - NO: This user does not own the schema.
- schema: Schemas the rule applies to. If you do not specify schema, the rule applies to all schemas.
  - names: List of schema names.
  - name_regexp: Regular expression. The rule applies to the schemas whose names match the regular expression.
  You can specify either names or name_regexp but not both.
- catalog: Catalogs the rule applies to. If you do not specify catalog, the rule applies to all cluster catalogs.
  - ids: List of catalog IDs. These must be the existing catalogs.
  - names: List of catalog names. These must be the existing catalogs.
  - name_regexp: Regular expression. The rule applies to the catalogs whose names match the regular expression.
  You can specify only one of the following: ids, names, or name_regexp.
- groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.
- users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.
- description: Rule description.
If you have already set the access rules, open access_control.yaml and edit it as needed. You can:
- Add new rules.
- Update the existing ones.
- Delete the rules you no longer need.

Run this command:

yc managed-trino cluster set-access-control <cluster_name_or_ID> \
  --from-file access_control.yaml

You can get the cluster ID and name with the list of clusters in the folder.

Open the current Terraform configuration file describing your infrastructure.

To learn how to create this file, see Creating a cluster.
If you have not set any access rules yet, add the yandex_trino_access_control resource containing the schemas rule list.
```
resource "yandex_trino_cluster" "<cluster_name>" {
  ...
}

resource "yandex_trino_catalog" "<catalog_1_name>" {
  ...
}

resource "yandex_trino_catalog" "<catalog_2_name>" {
  ...
}

...

resource "yandex_trino_catalog" "<catalog_N_name>" {
  ...
}

resource "yandex_trino_access_control" "trino_access_control" {
  ...
  cluster_id  = yandex_trino_cluster.<cluster_name>.id
  schemas = [
    # Rule 1
    {
      owner         = "<whether_or_not_user_owns_schema>"
      schema        = {
        names       = ["<list_of_schema_names>"]
        name_regexp = "<regular_expression>"
      }
      catalog       = {
        ids         = [
          yandex_trino_catalog.<catalog_1_name>.id,
          yandex_trino_catalog.<catalog_2_name>.id,
          ... 
          yandex_trino_catalog.<catalog_N_name>.id
        ]
        name_regexp = "<regular_expression>"
      }
      users         = ["<list_of_user_IDs>"]
      groups        = ["<list_of_group_IDs>"]
      description   = "<rule_description>"
    },
    # Rule 2
    {
      ... 
    },
    ...
    # Rule N
    {
      ... 
    }
  ]
  ...
}
```
Where:
- schemas: List of schema rule sections. Each rule contains the required owner parameter, as well as the optional schema, catalog, groups, users, and description parameters.
- owner: Whether or not the user owns the schema:
  - YES: This user owns the schema.
  - NO: This user does not own the schema.
- schema: Schemas the rule applies to. If the schema section is not specified, the rule applies to all schemas.
  - names: List of schema names.
  - name_regexp: Regular expression. The rule applies to the schemas whose names match the regular expression.
  You can specify either names or name_regexp but not both.
- catalog: Catalogs the rule applies to. If the catalog section is not specified, the rule applies to all cluster catalogs.
  - ids: List of catalog IDs. These must exist or be created in the same manifest.
  - name_regexp: Regular expression. The rule applies to the catalogs whose names match the regular expression.
  You can specify either ids or name_regexp but not both.
- groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.
- users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.
- description: Rule description.
If you have already set the access rules, edit the yandex_trino_access_control resource description. You can:
- Add new rules.
- Update the existing ones.
- Delete the rules you no longer need.
Make sure the settings are correct.
1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
2. Run this command:
```
terraform validate
```
  Terraform will show any errors found in your configuration files.
Confirm updating the resources.
1. Run this command to view the planned changes:
```
terraform plan
```
  If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
2. If everything looks correct, apply the changes:
  1. Run this command:
```
terraform apply
```
  2. Confirm updating the resources.
  3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

Get an IAM token for API authentication and put it in an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Clone the cloudapi repository:
```
cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
```
Below, we assume that the repository contents reside in the ~/cloudapi/ directory.
If you have not set any access rules yet, create a file named body.json and paste the following code into it:
```
{
  "cluster_id": "<cluster_ID>",
  "update_mask": {
    "paths": [
      "trino.access_control.schemas"
    ]
  },
  "trino": {
    "access_control": {
      "schemas": [
        {
          "owner": "<whether_or_not_user_owns_schema>",
          "schema": {
            "names": {
              "any": [
                "<list_of_schema_names>"
              ]
            },
            "name_regexp": "<regular_expression>"
          },
          "catalog": {
            "ids": {
              "any": [
                "<list_of_catalog_IDs>"
              ]
            },
            "names": {
              "any": [
                "<list_of_catalog_names>"
              ]
            },
            "name_regexp": "<regular_expression>"
          },
          "users": [
            "<list_of_user_IDs>"
          ],
          "groups": [
            "<list_of_group_IDs>"
          ],
          "description": "<rule_description>"
        },
        {
          <Rule_2_section>
        },
        ...
        {
          <Rule_N_section>
        }
      ]
    }
  }
}
```
Where:
- cluster_id: Cluster ID.
  
  You can get the cluster ID with the list of clusters in the folder.
- update_mask: List of parameters to update as an array of strings (paths[]).
  Format for listing settings
  "update_mask": { "paths": [ "<setting_1>", "<setting_2>", ... "<setting_N>" ] }
  Warning
  
  When you update a cluster, all parameters of the object you are modifying will take their defaults unless explicitly provided in the request. To avoid this, list the settings you want to change in the update_mask parameter.
- access_control: Access rule configuration in the cluster.
- schemas: List of schema rule sections. Each rule contains the required owner parameter, as well as the optional schema, catalog, groups, users, and description parameters.
- owner: Whether or not the user owns the schema:
  - YES: This user owns the schema.
  - NO: This user does not own the schema.
- schema: Schemas the rule applies to. If the schema section is not specified, the rule applies to all cluster schemas.
  - names: List of schema names.
  - name_regexp: Regular expression. The rule applies to the schemas whose names match the regular expression.
  The schema section must contain either the nested names section or the name_regexp parameter.
- catalog: Catalogs the rule applies to. If the catalog section is not specified, the rule applies to all cluster catalogs.
  - ids: List of catalog IDs. These must be the existing catalogs.
  - names: List of catalog names. These must be the existing catalogs.
  - name_regexp: Regular expression. The rule applies to the catalogs whose names match the regular expression.
  The catalog section must contain either one of the nested ids or names sections, or the name_regexp parameter.
- groups: List of group IDs the rule applies to. If you do not specify groups, the rule applies to all user groups.
- users: List of user IDs the rule applies to. If you do not specify users, the rule applies to all users.
- description: Rule description.
If you have already set the access rules, open the existing body.json rules file and edit it as needed. You can:
- Add new rules.
- Update the existing ones.
- Delete the rules you no longer need.

Call the ClusterService.Update method, e.g., via the following gRPCurl request:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/trino/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d @ \
  trino.api.cloud.yandex.net:443 \
  yandex.cloud.trino.v1.ClusterService.Update \
  < body.json

Check the server response to make sure your request was successful.

Example of setting schema access rules

Let's assume you need to specify schema owners in a Trino cluster as shown below:

The user with the banned_user_id ID does not own any schemas.
Users belonging to the groups whose IDs are data_engineering_group_id or admins_group_id own the b2b and b2c schemas in catalogs with the naming pattern of dwh_.*.
All other users do not own any schemas.

CLI

Terraform

gRPC API

The access_control.yaml file for this rule set is as follows:

schemas:
  - users:
      - banned_user_id
    owner: NO

  - groups:
      - data_engineering_group_id
      - admins_group_id
    schema:
      names:
        any:
          - b2b
          - b2c
    catalog:
      name_regexp: "dwh_.*"
    owner: YES

The configuration file for this rule set is as follows:

resource "yandex_trino_access_control" "trino_access_control" {
  ...
  cluster_id  = <cluster_ID>
  schemas = [
    {
      users         = ["banned_user_id"]
      owner         = "NO"
    },
    {
      groups        = ["data_engineering_group_id", "admins_group_id"]
      schema        = {
        names       = ["b2b", "b2c"]
      }        
      catalog       = {
        name_regexp = "dwh_.*"
      }
      owner         = "YES"
    }
  ]
  ...
}

The body.json file for this rule set is as follows:

{
  "cluster_id": "<cluster_ID>",
  "update_mask": {
    "paths": [
      "trino.access_control.schemas"
    ]
  },
  "trino": {
    "access_control": {
      "schemas": [
        {
          "users": [
            "banned_user_id"
          ],
          "owner": "NO"
        },
        {
          "groups": [
            "data_engineering_group_id",
            "admins_group_id"
          ],
          "schema": {
            "names": {
              "any": [
                "b2b",
                "b2c"
              ]
            }
          },
          "catalog": {
            "name_regexp": "dwh_.*"
          },
          "owner": "YES"
        }
      ]
    }
  }
}

Assigning access rules for schemas in Managed Service for Trino

Setting rules when creating a clusterSetting rules when creating a cluster

Setting rules for an existing clusterSetting rules for an existing cluster

Example of setting schema access rulesExample of setting schema access rules

Was the article helpful?

Setting rules when creating a cluster

Setting rules for an existing cluster

Example of setting schema access rules