[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for Apache Airflow™](../index.md) > [Concepts](index.md) > Impersonation

# Impersonation in Managed Service for Apache Airflow™

_Impersonation_ in Managed Service for Apache Airflow™ is when an Apache Airflow™ cluster performs actions with user resources on behalf of a service account.

By default, an Apache Airflow™ cluster does not have permissions to access user resources. To provide access to such resources, [create a service account](../../iam/operations/sa/create.md#create-sa) with the required roles and link it to the Apache Airflow™ cluster when [creating](../operations/cluster-create.md#create-cluster) or [updating](../operations/cluster-update.md) the cluster. After that, you will be able to authenticate on behalf of the service account from the code of DAG files.

Impersonation enables an Apache Airflow™ cluster to support integration with other Yandex Cloud services. These include [Yandex Cloud Logging](../../logging/index.md), [Yandex Lockbox](../../lockbox/concepts/index.md), and [Yandex Monitoring](../../monitoring/concepts/index.md).

 For a cluster to be able to work with the services, assign the `managed-airflow.integrationProvider` [role](../security/index.md#managed-airflow-integrationProvider) to its service account. With this role, a cluster can write logs to Cloud Logging, access Yandex Lockbox secrets, and send metrics to Monitoring.

Managed Service for Apache Airflow™ supports integration with other services via the [Yandex Cloud Python SDK](https://github.com/yandex-cloud/python-sdk) or [Airflow Yandex Provider](https://airflow.apache.org/docs/apache-airflow-providers-yandex/stable/index.html).

## Services available for integration {#services}

### Cloud Logging {#cloud-logging-integration}

Cloud Logging is a service that stores and reads logs for Yandex Cloud services. If a Managed Service for Apache Airflow™ cluster has logging enabled, its logs are saved to a selected Cloud Logging log group.

For more on setting up logging, see [Transferring cluster logs](../operations/af-logging.md).

### Monitoring {#monitoring-integration}

Monitoring is a service that collects and stores metrics for Yandex Cloud services. Metrics are displayed as charts on the cluster page under **Monitoring**. They show the current state and health of the cluster. Metrics are available by default in all Managed Service for Apache Airflow™ clusters. For a list of available metrics, see the relevant [reference](../metrics.md).

### Yandex Lockbox {#lockbox-integration}

Yandex Lockbox is a service for centralized storage of secrets. In Yandex Lockbox, you can store data to use in DAG files, such as configuration data, variables and Apache Airflow™ connection parameters. You can see the example of such data in [Automating Yandex Data Processing operations](../tutorials/data-processing-automation.md#dag).

By default, Apache Airflow™ stores sensitive data in a metadata storage. In which case you have to manage each Apache Airflow™ cluster's secrets manually via the UI or API. To automate management of secrets, store them in Yandex Lockbox. For more information, see [this Apache Airflow™ guide](https://airflow.apache.org/docs/apache-airflow/stable/security/secrets/secrets-backend/index.html).

To use Yandex Lockbox features in an Apache Airflow™ cluster, [create a secret](../../lockbox/operations/secret-create.md) with the required data and [provide the permission to access it](../../lockbox/operations/secret-access.md) to the service account attached to the cluster. After that, you will be able to use data from the secret in the cluster's DAG files.


#### Use cases {#examples-lockbox}

* [Configuring an SMTP server to send e-mail notifications](../tutorials/test-smtp-notification.md)
* [Storing Apache Airflow™ connections in Yandex Lockbox](../operations/lockbox-secrets-in-maf-cluster.md)


## Tools available for integration with Yandex Cloud {#instruments}

### Python SDK {#yc-python-sdk-integration}

The [Yandex Cloud Python SDK](https://github.com/yandex-cloud/python-sdk) allows you to manage Yandex Cloud resources from DAG files of the Apache Airflow™ cluster on behalf of a [service account](../../functions/operations/function-sa.md). To do this, create the `yandexcloud.SDK()` object in a DAG file without specifying authentication parameters. The DAG file will be authenticated using the [IAM token](../../iam/concepts/authorization/iam-token.md) of the service account attached to the cluster.


#### Use cases {#examples-python}

* [Sending requests to the Yandex Cloud API via the Yandex Cloud Python SDK](../tutorials/using-python-sdk.md)


### Airflow Yandex Provider {#yc-airflow-provider-integration}

Managed Service for Apache Airflow™ clusters with enabled impersonation have an automatically configured `yandexcloud_default` connection used by default by all the Airflow Yandex Provider operators. To use it, create a DAG file without specifying the `yandex_conn_id` parameter. The operator will be authenticated using the IAM token of the service account attached to the cluster.

For an integration example, see [Automating Yandex Query tasks with Yandex Managed Service for Apache Airflow™](../tutorials/airflow-auto-tasks.md).