[Yandex Cloud documentation](../../index.md) > [Yandex MetaData Hub](../index.md) > Apache Hive™ Metastore > Concepts > Impersonation in Apache Hive™ Metastore

# Impersonation in Apache Hive™ Metastore

_Impersonation_ allows a [Apache Hive™ Metastore](metastore.md) cluster to work with cloud resources on behalf of a [service account](../../iam/concepts/users/service-accounts.md).

By default, a Apache Hive™ Metastore cluster does not have permissions to access user resources. To provide access to such resources, [create a service account](../../iam/operations/sa/create.md#create-sa) with the required roles and attach it to the Apache Hive™ Metastore cluster when [creating the cluster](../operations/metastore/cluster-create.md#create-cluster). After that, Apache Hive™ Metastore will have access to user resources by authorizing on behalf of a service account.

The roles required for the service account depend on which service you are going to use Apache Hive™ Metastore with. For example, you need the `logging.writer` role to configure cluster log export in [Yandex Cloud Logging](../../logging/index.md), and the `monitoring.editor`, to use [Yandex Monitoring](../../monitoring/index.md) dashboards.

When creating a service account for Apache Hive™ Metastore, we recommend using the `managed-metastore.integrationProvider` role as it already includes the `logging.writer` and `monitoring.editor` roles. To learn more about the role features, see this [reference](../security/metastore-roles.md#managed-metastore-integrationProvider).

_Apache® and [Apache Hive™](https://hive.apache.org/) are either registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries._