[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for Trino](../index.md) > [Step-by-step guides](index.md) > Clusters > Creating a cluster

# Creating an Trino cluster

Each Managed Service for Trino cluster consists of Trino components: a [coordinator](../concepts/index.md#coordinator) and [workers](../concepts/index.md#workers), which may have multiple instances.

## Roles for creating a cluster {#roles}

To create a Managed Service for Trino cluster, your Yandex Cloud account needs the following roles:

* [managed-trino.admin](../security.md#managed-trino-admin): To create a cluster.
* [vpc.user](../../vpc/security/index.md#vpc-user): To use the cluster [network](../../vpc/concepts/network.md#network).
* [logging.reader](../../logging/security/index.md#logging-reader): To view cluster logs.
* [logging.editor](../../logging/security/index.md#logging-editor): To manage cluster logging settings.
* [iam.serviceAccounts.user](../../iam/security/index.md#iam-serviceAccounts-user): To attach a service account to a cluster.

Make sure to assign the `managed-trino.integrationProvider` and `storage.editor` roles to the cluster's [service account](../../iam/concepts/users/service-accounts.md). The cluster will thus get the permissions it needs to work with user resources. For more information, see [Impersonation](../concepts/impersonation.md).

For more information about assigning roles, see [this Yandex Identity and Access Management guide](../../iam/operations/roles/grant.md).

## Creating a cluster {#create-cluster}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a Managed Service for Trino cluster.
    1. Navigate to **Managed Service for Trino**.
    1. Click **Create cluster**.
    1. Under **Basic parameters**:

        1. Give the cluster a name. The name must be unique within the folder.
        1. Optionally, enter a description for the cluster.
        1. Optionally, create [labels](../../resource-manager/concepts/labels.md):

            1. Click **Add label**.
            1. Enter a label in `key: value` format.
            1. Press **Enter**.

        1. Select an existing [service account](../../iam/concepts/users/service-accounts.md) or [create a new one](../../iam/operations/sa/create.md).

            Make sure to assign the `managed-trino.integrationProvider` and `storage.editor` roles to the service account.

        1. Select the Trino version.

            {% note info %}
            
            After you create a cluster, you can change your Trino version. You can either upgrade or downgrade the version.
            
            {% endnote %}

    1. Under **Network settings**:

        1. Select a [network](../../vpc/operations/network-create.md), [subnet](../../vpc/operations/subnet-create.md), and [security group](../../vpc/concepts/security-groups.md) for the cluster.
        1. Optionally, enable the **Private access** parameter to make the cluster accessible only via a [service connection](../concepts/network.md#private-endpoint).

    1. Under **Retry policy**, specify the [fault-tolerant query execution](../concepts/retry-policy.md) parameters:
        1. Select an **Object type for retry**.
           * **Task**: Retries the intermediate task within the query that caused worker failure.
           * **Query**: Retries all [stages of the query](../concepts/index.md#query-execution) where worker failure occurred.
        1. Optionally, specify additional parameters in `key: value` format in the **Retry parameters** field. Learn more about parameters in [this Trino guide](https://trino.io/docs/current/admin/fault-tolerant-execution.html#advanced-configuration).
        1. Optionally, specify additional Exchange Manager storage parameters in `key: value` format in the **Storage parameters** field. Learn more about parameters in [this Trino guide](https://trino.io/docs/current/admin/fault-tolerant-execution.html#id1).

    1. Configure the [coordinator](../concepts/index.md#coordinator) and [workers](../concepts/index.md#workers).
    1. Optionally, under **Catalogs**, add [Trino catalogs](../concepts/index.md#catalog). You can do this either when creating the cluster or later. For more information, see [Creating a Trino catalog](catalog-create.md).
    1. Optionally, under **Access settings**, set [rules for access to cluster objects](../concepts/access-control.md). For more information, see [Access management in Managed Service for Trino](access-control.md).
    1. Optionally, under **Resource management**, [configure the resource groups](../concepts/access-control.md). For more information, see [Managing resource groups in Managed Service for Trino](manage-resource-groups.md).
    1. Under **Advanced settings**:

        1. Optionally, enable cluster deletion protection.
        1. Optionally, select cluster [maintenance](../concepts/maintenance.md) time:

            * To enable maintenance at any time, select **At any time** (default).
            * To specify the preferred maintenance start time, select **By schedule** and specify the day of the week and the UTC time interval. For example, you can choose a time when the cluster is least loaded.
            
            Both active and stopped clusters are subject to maintenance. Maintenance operations include DBMS updates, patches, etc.
        
        1. Optionally, set the TLS properties.
        
           ## TLS parameters {#tls}
           
           Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
           
           ## TLS for PG and CH {#tls-pg-ch}
           
           {% note info %}
                      
           If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                      
           {% endnote %}
           
           ## List of certificates {#cert-list}
           
           Provide one or more custom certificates in PEM format:
           * Self-signed certificate.
           * Certificate issued by a third-party certification authority with a chain of intermediate certificates.
           
           Upload one or more user certificates in PEM format:
           * Self-signed certificate.
           * Certificate issued by a third-party certification authority with a chain of intermediate certificates. You must upload the certificate together with its certificate chain in one field.

              {% cut "Example" %}
              
              ```text
              -----BEGIN CERTIFICATE-----
              <certificate>
              -----END CERTIFICATE-----
              -----BEGIN CERTIFICATE-----
              <intermediate_certificate_1>
              -----END CERTIFICATE-----
              ...
              -----BEGIN CERTIFICATE-----
              <intermediate_certificate_N>
              -----END CERTIFICATE-----
              -----BEGIN CERTIFICATE-----
              <root_certificate>
              -----END CERTIFICATE-----
              ```
              
              {% endcut %}

           ## TLS parameters {#tls}
           
           Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
           
           ## TLS for PG and CH {#tls-pg-ch}
           
           {% note info %}
                      
           If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                      
           {% endnote %}
           
           ## List of certificates {#cert-list}
           
           Provide one or more custom certificates in PEM format:
           * Self-signed certificate.
           * Certificate issued by a third-party certification authority with a chain of intermediate certificates.

        1. Optionally, configure logging:

            1. Enable the **Write logs** setting.
            1. Select the log destination:
                * **Folder**: Select a folder from the list. Logs will be written to the selected folder's default log group.
                * **Group**: Select a [log group](../../logging/concepts/log-group.md) from the list or create a new one.
            1. Select **Min. logging level** from the list.

    1. Click **Create**.

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    To create a Managed Service for Trino cluster:

    1. Check whether the folder has any subnets for cluster hosts:

        ```bash
        yc vpc subnet list
        ```

        If there are no subnets in the folder, [create the right ones](../../vpc/operations/subnet-create.md) in VPC.

    1. View the description of the CLI command for creating a cluster:

        ```bash
        yc managed-trino cluster create --help
        ```

    1. Specify the cluster properties in this command (the example does not show all that are available):

        ```bash
        yc managed-trino cluster create \
           --name <cluster_name> \
           --version <version> \
           --service-account-id <service_account_ID> \
           --subnet-ids <list_of_subnet_IDs> \
           --security-group-ids <list_of_security_group_IDs> \
           --private-access \
           --coordinator resource-preset-id=<class_of_computing_resources> \
           --worker resource-preset-id=<class_of_computing_resources>,count=<number_of_workers> \
           --deletion-protection \
           --trusted-certs-from-files <list_of_certificate_paths>
        ```

        Where:

        * `--name`: Cluster name. It must be unique within the folder.
        * `--version`: Trino version.

          {% note info %}
          
          After you create a cluster, you can change your Trino version. You can either upgrade or downgrade the version.
          
          {% endnote %}
        
        * `--service-account-id`: Service account ID.
        * `--subnet-ids`: List of subnet IDs.
        * `--security-group-ids`: List of security group IDs.
        * `--private-access`: Private access to the cluster. Use this parameter to make the cluster accessible only via a [service connection](../concepts/network.md#private-endpoint).
        * `--coordinator`: [Coordinator](../concepts/index.md#coordinator) configuration.

            * `resource-preset-id`: [Class of the coordinator's computing resources](../concepts/instance-types.md).

        * `--worker`: [Worker](../concepts/index.md#workers) configuration:

            * `resource-preset-id`: [Class of the worker's computing resources](../concepts/instance-types.md).
            * `count`: Fixed number of workers.
            * `minCount`: Minimum number of workers for autoscaling.
            * `maxCount`: Maximum number of workers for autoscaling.

            Specify either a fixed number of workers (`count`), or minimum and maximum number of workers (`minCount`, `maxCount`) for automatic scaling.

        * `--deletion-protection`: Cluster protection from accidental deletion, `true` or `false`.

            Even with deletion protection on, one can still connect to the cluster manually and delete it.
        
        * `--trusted-certs-from-files`: List of certificate paths, separated by commas.

           ## TLS parameters {#tls}
           
           Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
           
           ## TLS for PG and CH {#tls-pg-ch}
           
           {% note info %}
                      
           If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                      
           {% endnote %}
           
           ## List of certificates {#cert-list}
           
           Provide one or more custom certificates in PEM format:
           * Self-signed certificate.
           * Certificate issued by a third-party certification authority with a chain of intermediate certificates.
        
           ## TLS parameters {#tls}
           
           Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
           
           ## TLS for PG and CH {#tls-pg-ch}
           
           {% note info %}
                      
           If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                      
           {% endnote %}
           
           ## List of certificates {#cert-list}
           
           Provide one or more custom certificates in PEM format:
           * Self-signed certificate.
           * Certificate issued by a third-party certification authority with a chain of intermediate certificates.
           
           ## TLS parameters {#tls}
           
           Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
           
           ## TLS for PG and CH {#tls-pg-ch}
           
           {% note info %}
                      
           If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                      
           {% endnote %}
           
           ## List of certificates {#cert-list}
           
           Provide one or more custom certificates in PEM format:
           * Self-signed certificate.
           * Certificate issued by a third-party certification authority with a chain of intermediate certificates.

    1. Set these logging parameters to activate sending Trino logs to [Yandex Cloud Logging](../../logging/index.md):

        ```bash
        yc managed-trino cluster create <cluster_name> \
           ...
           --log-enabled \
           --log-folder-id <folder_ID> \
           --log-min-level <logging_level>
        ```

        Where:

        * `--log-enabled`: Enables logging.
        * `--log-folder-id`: Folder ID. Logs will be written to the default [log group](../../logging/concepts/log-group.md) for this folder.
        * `--log-group-id`: Custom log group ID. Logs will be written to this group.

            You can specify either `--log-folder-id` or `--log-group-id` but not both.

        * `--log-min-level`: Minimum logging level. Possible values: `TRACE`, `DEBUG`, `INFO` (default), `WARN`, `ERROR`, and `FATAL`.

    1. To enable a [fault-tolerant query execution](../concepts/retry-policy.md) policy, specify these parameters:

        ```bash
        yc managed-trino cluster create <cluster_name> \
           ...
           --retry-policy-enabled \
           --retry-policy \
           --retry-policy-additional-properties <list_of_additional_retry_policy_parameters> \
           --retry-policy-exchange-manager-service-s3 \
           --retry-policy-exchange-manager-additional-properties <list_of_additional_storage_parameters>
        ```

        Where:

        * `--retry-policy-enabled`: Enables the retry policy.
        * `--retry-policy`: Query retry method. The possible values are:

            * `task`: Retries the intermediate task within the query that caused worker failure.
            * `query`: Retries all [stages of the query](../concepts/index.md#query-execution) in which the worker failed.

        * `--retry-policy-additional-properties`: Additional query retry parameters in `<key>=<value>` format. Learn more about parameters in [this Trino guide](https://trino.io/docs/current/admin/fault-tolerant-execution.html#advanced-configuration).
        * `--retry-policy-exchange-manager-service-s3`: Use an S3 storage to write data when retrying queries.
        * `--retry-policy-exchange-manager-additional-properties`: Additional storage parameters in `<key>=<value>` format. Learn more about parameters in [this Trino guide](https://trino.io/docs/current/admin/fault-tolerant-execution.html#id1).

    1. To add the settings of query execution and resource allocation for queries, specify this parameter:

        ```bash
        yc managed-trino cluster create <cluster_name> \
           ...
           --query-properties <list_of_settings>
        ```

        Where:

        * `--query-properties`: Settings of query execution and cluster resource allocation for queries in `<key>=<value>` format.

          Learn more about the [settings of cluster resource allocation for queries](https://trino.io/docs/current/admin/properties-resource-management.html) and [query execution settings](https://trino.io/docs/current/admin/properties-query-management.html).

    1. To set up a maintenance window (including for disabled clusters), provide the relevant value in the `--maintenance-window` parameter:

        ```bash
        yc managed-trino cluster create <cluster_name> \
           ...
           --maintenance-window type=<maintenance_type>,`
                               `day=<day_of_week>,`
                               `hour=<hour> \
        ```

        Where `type` is the maintenance type:

        * `anytime`: Any time (default).
        * `weekly`: On a schedule. For this value, also specify the following:
            * `day`: Day of week, i.e., `MON`, `TUE`, `WED`, `THU`, `FRI`, `SAT`, or `SUN`.
            * `hour`: Sequence number of UTC hour interval, from `1` to `24`.
        
              > For example, `1` stands for the interval from `00:00` to `01:00`, and `5`, from `04:00` to `05:00`.

    1. To configure [cluster object access rules](../concepts/access-control.md), create a file named `access_control.yaml` defining the rules and provide its name in the `--access-control-from-file` parameter:

        ```bash
        yc managed-trino cluster create <cluster_name> \
           ...
           --access-control-from-file access_control.yaml
        ```

       For more information, see [Access management in Managed Service for Trino](access-control.md).

- Terraform {#tf}

    With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
    
    Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
    
    For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

    If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
    
    
    To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

    To create a Managed Service for Trino cluster:

    1. In the configuration file, describe the resources you are creating:

        * Managed Service for Trino cluster: Cluster description.

        * Managed Service for Trino catalog: Catalog description.

        * Network: Description of the [cloud network](../../vpc/concepts/network.md#network) where a cluster will be located. If you already have a suitable network, you don't have to describe it again.

        * Subnets: Description of the [subnets](../../vpc/concepts/network.md#subnet) to connect the cluster hosts to. If you already have suitable subnets, you don't have to describe them again.

        Here is an example of the configuration file structure:
        
        ```hcl
        resource "yandex_trino_cluster" "<cluster_name>" {
          name                = "<cluster_name>"
          service_account_id  = "<service_account_ID>"
          subnet_ids          = [yandex_vpc_subnet.<subnet_name>.id]
          security_group_ids  = [<list_of_security_group_IDs>]
          private_access      = <enable_private_access_to_cluster>
          deletion_protection = <protect_cluster_from_deletion>
          version             = "<version>"
        
          coordinator = {
            resource_preset_id = "<class_of_computing_resources>"
          }
        
          worker = {
            fixed_scale = {
              count = 4
            }
            resource_preset_id = "<class_of_computing_resources>"
          }
        }
        
        resource "yandex_vpc_network" "<network_name>" {
          name = "<network_name>"
        }
        
        resource "yandex_vpc_subnet" "<subnet_name>" {
          name           = "<subnet_name>"
          zone           = "<availability_zone>"
          network_id     = "yandex_vpc_network.<network_name>.id"
          v4_cidr_blocks = ["<range>"]
        }
        ```
        
        Where:
        
        * `name`: Cluster name. It must be unique within the folder.
        * `service_account_id`: Service account ID.
        * `subnet_ids`: List of subnet IDs.
        * `security_group_ids`: List of security group IDs.
        * `private_access`: Private access to the cluster, `true` or `false`. Enable this parameter to make the cluster accessible only via a [service connection](../concepts/network.md#private-endpoint).
        * `deletion_protection`: Cluster deletion protection, `true` or `false`.
        
            Even with deletion protection on, one can still connect to the cluster manually and delete it.
        
        * `version`: Trino version.
            
            {% note info %}
            
            After you create a cluster, you can change your Trino version. You can either upgrade or downgrade the version.
            
            {% endnote %}
        
        * `coordinator`: [Coordinator](../concepts/index.md#coordinator) configuration.
        
            * `resource_preset_id`: [Class of the coordinator's computing resources](../concepts/instance-types.md)
        
        * `worker`: [Worker](../concepts/index.md#workers) configuration:
        
            * `resource_preset_id`: [Class of the worker's computing resources](../concepts/instance-types.md)
        
            * `fixed_scale`: Fixed worker scaling policy.
        
                * `count`: Number of workers.
        
            * `auto_scale`: Worker autoscaling policy.
        
                * `min_count`: Minimum number of workers.
                * `max_count`: Maximum number of workers.
        
            Specify either a fixed number of workers (`fixed_scale.count`), or minimum and maximum number of workers (`auto_scale.min_count`, `auto_scale.max_count`) for autoscaling.

    1. To create [Trino catalogs](../concepts/index.md#catalog) in the cluster, add the required number of `yandex_trino_catalog` resources to the configuration file. You can do this either when creating the cluster or later. For more information, see [Creating a Trino catalog](catalog-create.md).

    1. To enable sending Trino logs to [Yandex Cloud Logging](../../logging/index.md), add the `logging` section to the cluster description:

        ```hcl
        resource "yandex_trino_cluster" "<cluster_name>" {
          ...
          logging = {
            enabled   = <enable_logging>
            folder_id = <folder_ID>
            min_level = "<logging_level>"
          }
          ...
        }
        ```
        
        Where:
        
        * `enabled`: Enables logging, `true` or `false`.
        * `folder_id`: Folder ID. Logs will be written to the default [log group](../../logging/concepts/log-group.md) for this folder.
        * `log_group_id`: Custom log group ID. Logs will be written to this group.
        
            You can specify only one of the parameters: `folder_id` or `log_group_id`.
        
        * `min_level`: Minimum logging level. Possible values: `TRACE`, `DEBUG`, `INFO` (default), `WARN`, `ERROR`, and `FATAL`.

    1. To enable a [fault-tolerant query execution](../concepts/retry-policy.md) policy, add a `retry_policy` section to the cluster description:

        ```hcl
        resource "yandex_trino_cluster" "<cluster_name>" {
          ...
          retry_policy = {
            policy = "<object_type_for_retry>"
            additional_properties = {
              <list_of_additional_retry_policy_parameters>
            }
            exchange_manager = {
              additional_properties = {
                <list_of_additional_storage_parameters>
              }
              service_s3 = {}
            }
          }
          ...
        }
        ```
        
        Where:
        
        * `policy`: Query retry method. The possible values are:
        
            * `TASK`: Retries the intermediate task within the query that caused worker failure.
            * `QUERY`: Retries all [stages of the query](../concepts/index.md#query-execution) in which the worker failed.
        
        * `additional_properties`: Additional query retry parameters in `"<key>" = "<value>"` format. Learn more about parameters in [this Trino guide](https://trino.io/docs/current/admin/fault-tolerant-execution.html#advanced-configuration).
        
        * `exchangeManager`: Exchange Manager storage parameters:
        
            * `service_s3`: Use an S3 storage to write data when retrying queries.
            * `additional_properties`: Additional Exchange Manager storage parameters in `"<key>" = "<value>"` format. Learn more about parameters in [this Trino guide](https://trino.io/docs/current/admin/fault-tolerant-execution.html#id1).

    1. To specify the settings of query execution and resource allocation for queries, add the `query_properties` section to the cluster description:

        ```hcl
        resource "yandex_trino_cluster" "<cluster_name>" {
          ...
          query_properties = {
            <list_of_query_execution_settings>
            <list_of_cluster_resource_allocation_for_queries_settings>
          }
          ...
        }
        ```
        
        Where:
        
        * `query_properties`: Settings of query execution and cluster resource allocation for queries in `"<key>" = "<value>"` format.
        
            Learn more about the [settings of cluster resource allocation for queries](https://trino.io/docs/current/admin/properties-resource-management.html) and [query execution settings](https://trino.io/docs/current/admin/properties-query-management.html).

    1. To set the maintenance window that will also apply to stopped clusters, add the `maintenance_window` section to the cluster description:

        ```hcl
        resource "yandex_trino_cluster" "<cluster_name>" {
          ...
          maintenance_window = {
            type = <maintenance_type>
            day  = <day_of_week>
            hour = <hour>
          }
          ...
        }
        ```
        
        Where:
        
        * `type`: Maintenance type. The possible values include:
            * `ANYTIME`: Any time.
            * `WEEKLY`: On a schedule.
        * `day`: Day of week for the `WEEKLY` type, i.e., `MON`, `TUE`, `WED`, `THU`, `FRI`, `SAT`, or `SUN`.
        * `hour`: Sequence number of UTC hour interval for the `WEEKLY` type, from `1` to `24`.
        
          > For example, `1` stands for the interval from `00:00` to `01:00`, and `5`, from `04:00` to `05:00`.

    1. To set the TLS parameters:

       ```hcl
       resource "yandex_trino_cluster" "<cluster_name>" {
         ...
         tls = {
           trusted_certificates = [<list_of_certificates>]
         }
         ...
       }
       ```
       
       Where:
       
       * `tls`: TLS parameters.
         
           ## TLS parameters {#tls}
           
           Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
           
           ## TLS for PG and CH {#tls-pg-ch}
           
           {% note info %}
                      
           If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                      
           {% endnote %}
           
           ## List of certificates {#cert-list}
           
           Provide one or more custom certificates in PEM format:
           * Self-signed certificate.
           * Certificate issued by a third-party certification authority with a chain of intermediate certificates.
       
           * `trusted_certificates`: Comma-separated list of certificates.
       
             ## TLS parameters {#tls}
             
             Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
             
             ## TLS for PG and CH {#tls-pg-ch}
             
             {% note info %}
                        
             If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                        
             {% endnote %}
             
             ## List of certificates {#cert-list}
             
             Provide one or more custom certificates in PEM format:
             * Self-signed certificate.
             * Certificate issued by a third-party certification authority with a chain of intermediate certificates.
       
           ## TLS parameters {#tls}
           
           Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
           
           ## TLS for PG and CH {#tls-pg-ch}
           
           {% note info %}
                      
           If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                      
           {% endnote %}
           
           ## List of certificates {#cert-list}
           
           Provide one or more custom certificates in PEM format:
           * Self-signed certificate.
           * Certificate issued by a third-party certification authority with a chain of intermediate certificates.

    1. To set [access rules for cluster objects](../concepts/access-control.md), add the `yandex_trino_access_control` resource with the list of rules to the cluster description. For more information, see [Access management in Managed Service for Trino](access-control.md).

    1. Make sure the settings are correct.

        1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
        1. Run this command:
        
           ```bash
           terraform validate
           ```
        
           Terraform will show any errors found in your configuration files.

    1. Confirm resource changes.

        1. Run this command to view the planned changes:
        
           ```bash
           terraform plan
           ```
        
           If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
        
        1. If everything looks correct, apply the changes:
           1. Run this command:
        
              ```bash
              terraform apply
              ```
        
           1. Confirm updating the resources.
           1. Wait for the operation to complete.

    For more information about the resources you can create with Terraform, see [this provider guide](../../terraform/resources/trino_cluster.md).

- REST API {#api}

    1. [Get an IAM token for API authentication](../api-ref/authentication.md) and put it into an environment variable:

        ```bash
        export IAM_TOKEN="<IAM_token>"
        ```

    1. Create a file named `body.json` and paste the following code into it:

       {% note info %}

       This example does not use all available parameters. For a complete list of parameters, see [this API reference](../api-ref/Cluster/create.md#yandex.cloud.trino.v1.CreateClusterRequest).

       {% endnote %}

        ```json
        {
          "folderId": "<folder_ID>",
          "name": "<cluster_name>",
          "description": "<cluster_description>",
          "labels": { <label_list> },
          "trino": {
            "coordinatorConfig": {
              "resources": {
                "resourcePresetId": "<class_of_computing_resources>"
              }
            },
            "workerConfig": {
              "resources": {
                "resourcePresetId": "<class_of_computing_resources>"
              },
              "scalePolicy": {
                "autoScale": {
                  "minCount": "<minimum_number_of_instances>",
                  "maxCount": "<maximum_number_of_instances>"
                }
              }
            },
            "retryPolicy": {
              "policy": "<object_type_for_retry>",
              "exchangeManager": {
                "storage": {
                  "serviceS3": {}
                },
                "additionalProperties": {<additional_storage_parameters>}
              },
              "additionalProperties": {<additional_retry_parameters>}
            },
            "version": "<version>",
            "resourceManagement": {
              "query": {
                "properties": {
                  <query_execution_settings>,
                  <settings_of_cluster_resource_allocation_for_queries>
                }
              }
            },
            "tls": {
              "trustedCertificates": [ <list_of_certificates> ]
            },
            "accessControl": { <access_rule_configuration> }
          },
          "network": {
            "subnetIds": [ <list_of_subnet_IDs> ],
            "securityGroupIds": [ <list_of_security_group_IDs> ],
            "privateAccess": {
              "enabled": "<enable_private_access_to_cluster>"
            }
          },
          "deletionProtection": "<deletion_protection>",
          "serviceAccountId": "<service_account_ID>",
          "logging": {
            "enabled": "<use_of_logging>",
            "folderId": "<folder_ID>",
            "minLevel": "<logging_level>"
          }
        }
        ```

        Where:

        * `folderId`: Folder ID. You can get it with the [list of folders in the cloud](../../resource-manager/operations/folder/get-id.md).
        * `name`: Cluster name.
        * `description`: Cluster description.
        * `labels`: List of labels provided in `"<key>": "<value>"` format.
        * `trino`: Configuration of Trino cluster [components](../concepts/index.md#cluster-architecture).

            * `coordinatorConfig`: Coordinator configuration.

               * `resources.resourcePresetId`: [Class of the coordinator's computing resources](../concepts/instance-types.md).

            * `workerConfig`: Worker configuration.

               * `resources.resourcePresetId`: [Class of the worker's computing resources](../concepts/instance-types.md).

               * `scalePolicy`: Worker scaling policy:

                  * `fixedScale`: Fixed scaling policy.

                     * `count`: Number of workers.

                  * `autoScale`: Autoscaling policy.

                      * `minCount`: Minimum number of workers.
                      * `maxCount`: Maximum number of workers.

                  Specify either `fixedScale` or `autoScale`. 

            * `retryPolicy`: [Fault-tolerant query execution](../concepts/retry-policy.md) parameters.

               * `policy`: Query retry method. The possible values are:

                  * `TASK`: Retries the intermediate task within the query that caused worker failure.
                  * `QUERY`: Retries all [stages of the query](../concepts/index.md#query-execution) where worker failure occurred.

               * `exchangeManager.additionalProperties`: Additional Exchange Manager storage parameters in `key: value` format. Learn more about parameters in [this Trino guide](https://trino.io/docs/current/admin/fault-tolerant-execution.html#id1).

               * `additionalProperties`: Additional parameters in `key: value` format. Learn more about parameters in [this Trino guide](https://trino.io/docs/current/admin/fault-tolerant-execution.html#advanced-configuration).

            * `version`: Trino version.

               {% note info %}
               
               After you create a cluster, you can change your Trino version. You can either upgrade or downgrade the version.
               
               {% endnote %}

            * `resourceManagement.query.properties`: Settings of query execution and cluster resource allocation for queries in `key:value` format.

              Learn more about the [settings of cluster resource allocation for queries](https://trino.io/docs/current/admin/properties-resource-management.html) and [query execution settings](https://trino.io/docs/current/admin/properties-query-management.html).

            * `tls`: TLS parameters.

               ## TLS parameters {#tls}
               
               Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
               
               ## TLS for PG and CH {#tls-pg-ch}
               
               {% note info %}
                          
               If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                          
               {% endnote %}
               
               ## List of certificates {#cert-list}
               
               Provide one or more custom certificates in PEM format:
               * Self-signed certificate.
               * Certificate issued by a third-party certification authority with a chain of intermediate certificates.

               * `trustedCertificates`: Comma-separated list of certificates.

                  ## TLS parameters {#tls}
                  
                  Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
                  
                  ## TLS for PG and CH {#tls-pg-ch}
                  
                  {% note info %}
                             
                  If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                             
                  {% endnote %}
                  
                  ## List of certificates {#cert-list}
                  
                  Provide one or more custom certificates in PEM format:
                  * Self-signed certificate.
                  * Certificate issued by a third-party certification authority with a chain of intermediate certificates.
               
               ## TLS parameters {#tls}
               
               Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
               
               ## TLS for PG and CH {#tls-pg-ch}
               
               {% note info %}
                          
               If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                          
               {% endnote %}
               
               ## List of certificates {#cert-list}
               
               Provide one or more custom certificates in PEM format:
               * Self-signed certificate.
               * Certificate issued by a third-party certification authority with a chain of intermediate certificates.

            * `accessControl`: Configuration of [cluster object access rules](../concepts/access-control.md). For more information, see [Access management in Managed Service for Trino](access-control.md).

        * `network`: Network settings:

            * `subnetIds`: List of subnet IDs.
            * `securityGroupIds`: List of security group IDs.
            * `privateAccess.enabled`: Private access to the cluster, `true` or `false`. Enable this parameter to make the cluster accessible only via a [service connection](../concepts/network.md#private-endpoint).

        * `deletionProtection`: Enables cluster protection against accidental deletion. The possible values are `true` or `false`.

            Even with deletion protection on, one can still connect to the cluster manually and delete it.

        * `serviceAccountId`: Service account ID.
        * `logging`: Logging parameters:

            * `enabled`: Enables logging. Logs generated by Trino components will be sent to Yandex Cloud Logging. The possible values are `true` or `false`.
            * `minLevel`: Minimum logging level. The possible values are `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`, and `FATAL`.
            * `folderId`: Folder ID. Logs will be written to the default [log group](../../logging/concepts/log-group.md) for this folder.
            * `logGroupId`: Custom log group ID. Logs will be written to this group.

            Specify either `folderId` or `logGroupId`.

    1. Call the [Cluster.create](../api-ref/Cluster/create.md) method, e.g., via the following [cURL](https://curl.se/) request:

        ```bash
        curl \
            --request POST \
            --header "Authorization: Bearer $IAM_TOKEN" \
            --url 'https://trino.api.cloud.yandex.net/managed-trino/v1/clusters'
            --data '@body.json'
        ```

    1. View the [server response](../api-ref/Cluster/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

- gRPC API {#grpc-api}

    1. [Get an IAM token for API authentication](../api-ref/authentication.md) and place it in an environment variable:

        ```bash
        export IAM_TOKEN="<IAM_token>"
        ```

    1. Clone the [cloudapi](https://github.com/yandex-cloud/cloudapi) repository:
       
       ```bash
       cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
       ```
       
       Below, we assume that the repository contents reside in the `~/cloudapi/` directory.

    1. Create a file named `body.json` and paste the following code into it:

       {% note info %}

       This example does not use all available parameters. For a complete list of parameters, see [this API reference](../api-ref/grpc/Cluster/create.md#yandex.cloud.trino.v1.CreateClusterRequest).

       {% endnote %}

        ```json
        {
          "folder_id": "<folder_ID>",
          "name": "<cluster_name>",
          "description": "<cluster_description>",
          "labels": { <label_list> },
          "trino": {
            "coordinator_config": {
              "resources": {
                "resource_preset_id": "<class_of_computing_resources>"
              }
            },
            "worker_config": {
              "resources": {
                "resource_preset_id": "<class_of_computing_resources>"
              },
              "scale_policy": {
                "auto_scale": {
                  "min_count": "<minimum_number_of_instances>",
                  "max_count": "<maximum_number_of_instances>"
                }
              }
            },
            "retry_policy": {
              "policy": "<object_type_for_retry>",
              "exchange_manager": {
                "storage": {
                  "service_s3": ""
                },
                "additional_properties": {<additional_storage_parameters>}
              },
              "additional_properties": {<additional_retry_parameters>}
            },
            "version": "<version>",
            "resource_management": {
              "query": {
                "properties": {
                  <query_execution_settings>,
                  <settings_of_cluster_resource_allocation_for_queries>
                }
              }
            },
            "tls": {
              "trusted_certificates": [ <list_of_certificates> ]
            },
            "access_control": { <access_rule_configuration> }
          },
          "network": {
            "subnet_ids": [ <list_of_subnet_IDs> ],
            "security_group_ids": [ <list_of_security_group_IDs> ],
            "private_access": {
              "enabled": "<enable_private_access_to_cluster>"
            }
          },
          "deletion_protection": "<deletion_protection>",
          "service_account_id": "<service_account_ID>",
          "logging": {
            "enabled": "<use_of_logging>",
            "folder_id": "<folder_ID>",
            "min_level": "<logging_level>"
          }
        }
        ```

        Where:

        * `folder_id`: Folder ID. You can get it with the [list of folders in the cloud](../../resource-manager/operations/folder/get-id.md).
        * `name`: Cluster name.
        * `description`: Cluster description.
        * `labels`: List of labels provided in `"<key>": "<value>"` format.
        * `trino`: Configuration of Trino cluster [components](../concepts/index.md#cluster-architecture).

            * `coordinator_config`: Coordinator configuration.

               * `resources.resource_preset_id`: [Class of the coordinator's computing resources](../concepts/instance-types.md).

            * `worker_config`: Worker configuration.

               * `resources.resource_preset_id`: [Class of the worker's computing resources](../concepts/instance-types.md).

               * `scale_policy`: Worker scaling policy:

                   * `fixed_scale`: Fixed scaling policy.

                      * `count`: Number of workers.

                   * `auto_scale`: Autoscaling policy.

                      * `min_count`: Minimum number of workers.
                      * `max_count`: Maximum number of workers.

                    Specify either `fixed_scale` or `auto_scale`.

            * `retry_policy`: [Fault-tolerant query execution](../concepts/retry-policy.md) parameters.

               * `policy`: Query retry method. The possible values are:

                  * `TASK`: Retries the intermediate task within the query that caused worker failure.
                  * `QUERY`: Retries all [stages of the query](../concepts/index.md#query-execution) where worker failure occurred.

               * `exchange_manager.additional_properties`: Additional Exchange Manager storage parameters in `key: value` format. Learn more about parameters in [this Trino guide](https://trino.io/docs/current/admin/fault-tolerant-execution.html#id1).

               * `additional_properties`: Additional parameters in `key: value` format. Learn more about parameters in [this Trino guide](https://trino.io/docs/current/admin/fault-tolerant-execution.html#advanced-configuration).

            * `version`: Trino version.

               {% note info %}
               
               After you create a cluster, you can change your Trino version. You can either upgrade or downgrade the version.
               
               {% endnote %}

            * `resource_management.query.properties`: Settings of query execution and cluster resource allocation for queries in `key:value` format.

              Learn more about the [settings of cluster resource allocation for queries](https://trino.io/docs/current/admin/properties-resource-management.html) and [query execution settings](https://trino.io/docs/current/admin/properties-query-management.html).

            * `tls`: TLS parameters.

               ## TLS parameters {#tls}
               
               Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
               
               ## TLS for PG and CH {#tls-pg-ch}
               
               {% note info %}
                          
               If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                          
               {% endnote %}
               
               ## List of certificates {#cert-list}
               
               Provide one or more custom certificates in PEM format:
               * Self-signed certificate.
               * Certificate issued by a third-party certification authority with a chain of intermediate certificates.

               * `trusted_certificates`: Comma-separated list of certificates.

                  ## TLS parameters {#tls}
                  
                  Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
                  
                  ## TLS for PG and CH {#tls-pg-ch}
                  
                  {% note info %}
                             
                  If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                             
                  {% endnote %}
                  
                  ## List of certificates {#cert-list}
                  
                  Provide one or more custom certificates in PEM format:
                  * Self-signed certificate.
                  * Certificate issued by a third-party certification authority with a chain of intermediate certificates.

               ## TLS parameters {#tls}
               
               Managed Service for Trino will use the specified certificates to connect to user database installations. For managed databases, the TLS certificate is added to the connection settings automatically.
               
               ## TLS for PG and CH {#tls-pg-ch}
               
               {% note info %}
                          
               If you are configuring TLS for the ClickHouse®, PostgreSQL, or MySQL® connectors, [create a connection](../../metadata-hub/operations/create-connection.md#on-premise-connection) to the custom installation in Connection Manager and enable TLS in the settings.
                          
               {% endnote %}
               
               ## List of certificates {#cert-list}
               
               Provide one or more custom certificates in PEM format:
               * Self-signed certificate.
               * Certificate issued by a third-party certification authority with a chain of intermediate certificates.

            * `access_control`: Configuration of [cluster object access rules](../concepts/access-control.md). For more information, see [Access management in Managed Service for Trino](access-control.md).

        * `network`: Network settings:

            * `subnet_ids`: List of subnet IDs.
            * `security_group_ids`: List of security group IDs.
            * `private_access.enabled`: Private access to the cluster, `true` or `false`. Enable this parameter to make the cluster accessible only via a [service connection](../concepts/network.md#private-endpoint).

        * `deletion_protection`: Enables cluster protection against accidental deletion. The possible values are `true` or `false`.

            Even with deletion protection on, one can still connect to the cluster manually and delete it.

        * `service_account_id`: Service account ID.
        * `logging`: Logging parameters:

            * `enabled`: Enables logging. Logs generated by Trino components will be sent to Yandex Cloud Logging. The possible values are `true` or `false`.
            * `min_level`: Minimum logging level. The possible values are `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`, and `FATAL`.
            * `folder_id`: Folder ID. Logs will be written to the default [log group](../../logging/concepts/log-group.md) for this folder.
            * `log_group_id`: Custom log group ID. Logs will be written to this group.

            Specify either `folder_id` or `log_group_id`.

    1. Call the [ClusterService/Create](../api-ref/grpc/Cluster/create.md) method, e.g., via the following [gRPCurl](https://github.com/fullstorydev/grpcurl) request:

        ```bash
        grpcurl \
            -format json \
            -import-path ~/cloudapi/ \
            -import-path ~/cloudapi/third_party/googleapis/ \
            -proto ~/cloudapi/yandex/cloud/trino/v1/cluster_service.proto \
            -rpc-header "Authorization: Bearer $IAM_TOKEN" \
            -d @ \
            trino.api.cloud.yandex.net:443 \
            yandex.cloud.trino.v1.ClusterService.Create \
            < body.json
        ```

    1. Check the [server response](../api-ref/grpc/Cluster/create.md#yandex.cloud.operation.Operation) to make sure your request was successful.

{% endlist %}

## Examples {#examples}

{% list tabs group=instructions %}

- CLI {#cli}

    Create a Managed Service for Trino cluster with the following test specifications:

    * Name: `mytr`.
    * Service account: `ajev56jp96ji********`.
    * Subnet: `b0rcctk2rvtr8efcch64`.
    * Security group: `enp6saqnq4ie244g67sb`.
    * Coordinator with [computing resource class](../concepts/instance-types.md) `c4-m16`.
    * Four workers with [computing resource class](../concepts/instance-types.md) `c4-m16`.
    * Accidental deletion protection enabled.

    Run this command:

    ```bash
    yc managed-trino cluster create \
       --name mytr \
       --service-account-id ajev56jp96ji******** \
       --subnet-ids b0rcctk2rvtr8efcch64 \
       --security-group-ids enp6saqnq4ie244g67sb \
       --coordinator resource-preset-id=c4-m16 \
       --worker resource-preset-id=c4-m16,count=4 \
       --deletion-protection
    ```

- Terraform {#tf}

    Create a Managed Service for Trino cluster and its supporting network, using the following test specifications:

    * Name: `mytr`.
    * Service account: `ajev56jp96ji********`.
    * Network: `mtr-network`.
    * Subnet: `mtr-subnet`. The subnet availability zone is `ru-central1-a`; the range is `10.1.0.0/16`.
    * Coordinator with [computing resource class](../concepts/instance-types.md) `c4-m16`.
    * Four workers with [computing resource class](../concepts/instance-types.md) `c4-m16`.
    * Accidental deletion protection enabled.

    The configuration file for this cluster is as follows:

    ```hcl
    resource "yandex_trino_cluster" "mytr" {
      name                = "mytr"
      service_account_id  = "ajev56jp96ji********"
      deletion_protection = true
      subnet_ids          = [yandex_vpc_subnet.mtr-subnet.id]

      coordinator = {
        resource_preset_id = "c4-m16"
      }

      worker = {
        fixed_scale = {
          count = 4
        }
        resource_preset_id = "c4-m16"
      }
    }

    resource "yandex_vpc_network" "mtr-network" {
      name = "mtr-network"
    }

    resource "yandex_vpc_subnet" "mtr-subnet" {
      name           = "mtr-subnet"
      zone           = "ru-central1-a"
      network_id     = yandex_vpc_network.mtr-network.id
      v4_cidr_blocks = ["10.1.0.0/16"]
    }
    ```

{% endlist %}