[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for Trino](../index.md) > [Concepts](index.md) > Impersonation

# Impersonation in Managed Service for Trino

_Impersonation_ in Managed Service for Trino is when an Trino cluster performs actions with user resources on behalf of a service account.

By default, an Trino cluster does not have permissions to access user resources. To provide access to such resources, [create a service account](../../iam/operations/sa/create.md#create-sa) with the required roles and link it to the Trino cluster when [creating](../operations/cluster-create.md#create-cluster) or [updating](../operations/cluster-update.md#change-sa) the cluster. With that done, the [coordinator](index.md#coordinator) and [workers](index.md#workers) will be able to authenticate as this service account. For example, Hive, Iceberg, and Delta Lake [connectors](index.md#connector) authenticate in Object Storage as the cluster service account.

Impersonation enables an Trino cluster to support integration with other Yandex Cloud services. These include [Yandex Cloud Logging](../../logging/index.md), [Yandex Monitoring](../../monitoring/concepts/index.md), and [Yandex Connection Manager](../../metadata-hub/concepts/connection-manager.md).

For a cluster to be able to interface with the services, assign the `managed-trino.integrationProvider` [role](../security.md#managed-trino-integrationProvider) to its service account. The role will allow the cluster to write logs to Cloud Logging or send metrics to Monitoring. To use connections from Connection Manager and their [secrets](../../metadata-hub/concepts/secret.md), assign the additional `connection-manager.user` and `lockbox.payloadViewer` roles to the cluster service account.

## Services available for integration {#services}

### Connection Manager {#connection-manager-integration}

Connection Manager is a service for managing parameters of connections to user database installations and secure password storage. If a Managed Service for Trino cluster [folder](index.md#catalog) indicates **Connection Manager** as connection type, the cluster service account gets connection parameters, such as network addresses, ports, encrypted username and password, by its ID in Connection Manager.

### Cloud Logging {#cloud-logging-integration}

Cloud Logging stores and reads logs collected by Yandex Cloud services. If logging is enabled in a Managed Service for Trino cluster, the cluster logs will be saved to the [default log group](../../logging/concepts/log-group.md) of the selected folder or to the custom log group in Cloud Logging.

You can enable logging when [creating](../operations/cluster-create.md) or [updating](../operations/cluster-update.md#change-additional-settings) a cluster.

### Monitoring {#monitoring-integration}

Monitoring enables collecting and storing the metrics of Yandex Cloud services. Metrics are displayed as charts on the cluster page under **Monitoring**. They show the current state and health of the cluster. Metrics are available by default in all Managed Service for Trino clusters. For a list of available metrics, see the relevant [reference](../metrics.md).