[Yandex Cloud documentation](../../../index.md) > [Yandex MPP Analytics for PostgreSQL](../../index.md) > [Step-by-step guides](../index.md) > Access from Trino

# Access from Trino

Enable **Trino access** in the Yandex MPP Analytics for PostgreSQL cluster settings to work with the Yandex MPP Analytics for PostgreSQL cluster's data from Managed Service for Trino. This setting enables encrypted data transmission between Greenplum® segments and Trino workers via the GPFDIST protocol.

{% note info %}

**Access from Trino** is a required configuration for reading data from Yandex MPP Analytics for PostgreSQL via GPFDIST in Managed Service for Trino. Encryption is used automatically; you do not need to configure it additionally.

{% endnote %}

## Getting started {#before-you-begin}

1. [Configure security groups](../connect/index.md#sg-for-trino) for interaction between the Yandex MPP Analytics for PostgreSQL and Managed Service for Trino clusters. Security groups determine which network connections are allowed.
1. Prepare the Greenplum® user and [Trino catalog with the Greenplum®/Cloudberry connector](../../../managed-trino/operations/catalog-create.md#gp-clouberry). To read data via GPFDIST, the user requires permissions to create writable external tables.

## Enabling access from Trino {#enable-trino-access}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the folder containing your cluster.
    1. [Navigate](https://console.yandex.cloud/link/managed-greenplum) to **Yandex MPP Analytics for PostgreSQL**.
    1. Select your cluster and click **Edit** at the top of the page.
    1. In the additional settings, enable **Access from Trino**.
    1. Click **Save** and wait for the cluster modification to complete.

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`.
    
    If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    1. View the description of the following cluster modification command:

        ```bash
        yc managed-greenplum cluster update --help
        ```

    1. Enable access from Trino:

        ```bash
        yc managed-greenplum cluster update <cluster_name_or_ID> \
            --trino-access=true
        ```

        The `--trino-access=true` parameter enables access from Trino with data encryption during transmission.

    1. Wait for the operation to complete and check the cluster settings:

        ```bash
        yc managed-greenplum cluster get <cluster_name_or_ID>
        ```

        Under `config.access`, the `trino` parameter must have the `true` value.

{% endlist %}

You can also enable access from Trino when [creating a cluster](../cluster-create.md): use the **Access from Trino** setting in the management console, or the `--trino-access=true` parameter of the `yc managed-greenplum cluster create`command in the CLI.

## Configuring data reading {#configure-reading}

In the Trino catalog with the Greenplum®/Cloudberry connector, [configure the settings](../../../managed-trino/operations/catalog-update.md) for reading via GPFDIST:

* `greenplum.gpfdist.server.enabled`: `true`
* `greenplum.gpfdist.read.enabled`: `true`

The connector will create external tables and orchestrate data transfer from Greenplum® segments to Trino workers. There is no need to create these external tables manually.

## Limitations {#limitations}

* Reading via GPFDIST with encryption requires a Managed Service for Trino cluster running version 476 that supports connector-side encryption.
* This setting is intended solely for integration with Managed Service for Trino.
* Access management from Trino via Terraform is not yet supported. Use the management console or CLI.
* Enabling access from Trino does not replace configuring security groups, database user permissions, and the Trino catalog.
* Configuring applies to data transfer via GPFDIST between Greenplum® segments and Trino workers. Database connection parameters are specified separately in the Trino catalog.
* [Limitations on reading data via GPFDIST](../../../managed-trino/concepts/greenplum-connector.md#gpfdist-reading) remain in effect.

_Greenplum® and Greenplum Database® are registered trademarks or trademarks of Broadcom Inc. in the United States and/or other countries._

_Apache® and Apache Cloudberry™ are registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries._