[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for OpenSearch](../index.md) > [Step-by-step guides](index.md) > Clusters > Configuring access to Object Storage

# Configuring access to Object Storage from an OpenSearch cluster


Managed Service for OpenSearch supports using Yandex Object Storage as an OpenSearch snapshot repository. This allows you to use Object Storage to [store backups](cluster-backups.md). For more about the snapshot repository, see [this OpenSearch guide](https://opensearch.org/docs/latest/opensearch/snapshots/snapshot-restore/).


To access Object Storage bucket data from a cluster:

1. [Attach the service account to the cluster](#connect-service-account).
1. [Configure access permissions](#configure-acl).
1. [Add a snapshot repository](#register-snapshot-repository).


Before you begin, [assign](../../iam/operations/roles/grant.md) the [iam.serviceAccounts.user](../../iam/security/index.md#iam-serviceAccounts-user) role or higher to your Yandex Cloud account. You will need this role in the following cases:


* To create or update a cluster and attach a service account to it.
* To restore a cluster attached to a service account from its backup.

## Attach the service account to the cluster {#connect-service-account}


1. When [creating](cluster-create.md) or [updating](update.md) a cluster, either select an existing [service account](../../iam/concepts/users/service-accounts.md) or [create a new one](../../iam/operations/sa/create.md).

1. [Assign](../../iam/operations/sa/assign-role-for-sa.md) the `storage.editor` role to this account.


## Configure access permissions {#configure-acl}

{% list tabs group=instructions %}

- Management console {#console}

    
    1. In the [management console](https://console.yandex.cloud), select the folder with the bucket you need. If there is no such bucket, [create](../../storage/operations/buckets/create.md) one.


    1. Navigate to **Object Storage**.
    1. Select the **Buckets** tab.
    1. Set up the [bucket ACL](../../storage/operations/buckets/edit-acl.md):
        1. In the **User name or e-mail** drop-down list, specify the service account [attached to the cluster](#connect-service-account).
        1. Set the `READ and WRITE` permissions for this service account.
        1. Click **Add** and **Save**.

{% endlist %}

## Add a snapshot repository {#register-snapshot-repository}

{% note alert %}

If a bucket is registered in an OpenSearch cluster as a snapshot repository, do not edit the bucket contents manually as this will disrupt the OpenSearch snapshot mechanism.

{% endnote %}

1. [Connect](connect/index.md) to the cluster.
1. Register the bucket as a snapshot repository using the public [OpenSearch API](https://opensearch.org/docs/latest/opensearch/snapshot-restore/#register-repository):

    ```http
    PUT --cacert ~/.opensearch/root.crt https://admin:<password>@<ID_of_OpenSearch_host_with_DATA_role>.mdb.yandexcloud.net:9200/_snapshot/<repository_name>
    ```

    In the request parameters, specify the bucket associated with the cluster service account:

    ```bash
    curl --request PUT \
         "https://admin:<password>@<ID_of_OpenSearch_host_with_DATA_role>.mdb.yandexcloud.net:9200/_snapshot/<repository_name>" \
         --cacert ~/.opensearch/root.crt \
         --header "Content-Type: application/json" \
         --data '{
           "type": "s3",
           "settings": {
             "endpoint": "storage.yandexcloud.net",
             "bucket": "<bucket_name>"
           }
         }'
    ```