[Yandex Cloud documentation](../../index.md) > [Yandex MetaData Hub](../index.md) > Connection Manager > Step-by-step guides > Creating a connection

# Creating a connection


You can create connections of the following types:
* [To a cluster with a managed database](#mdb-connection):
  * [Managed Service for PostgreSQL](#mdb-postgresql)
  * [Managed Service for ClickHouse®](#mdb-clickhouse)
  * [Managed Service for MySQL®](#mdb-mysql)
  * [Yandex Managed Service for Valkey™](#mdb-valkey)
  * [Managed Service for OpenSearch](#mdb-opensearch)
  * [Yandex StoreDoc](#mdb-mongodb)
  * [Managed Service for Apache Kafka®](#mdb-kafka)
  * [Yandex MPP Analytics for PostgreSQL](#mdb-greenplum)
* [To a custom database installation](#on-premise-connection):
  * [PostgreSQL](#postgresql-on-premise)
  * [ClickHouse®](#clickhouse-on-premise)
  * [MySQL®](#mysql-on-premise)
  * [Valkey™](#valkey-on-premise)
  * [Valkey™](#valkey-on-premise)
  * [Trino](#trino-on-premise)
  * [OpenSearch](#opensearch-on-premise)
  * [MongoDB](#mongodb-on-premise)
  * [Apache Kafka®](#kafka-on-premise)
  * [Greenplum®](#greenplum-on-premise)

## Connecting to a cluster with a managed database {#mdb-connection}

### Managed Service for PostgreSQL {#mdb-postgresql}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
  1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
  1. Click **Create connection**.
  1. Specify the connection name.
  1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
  1. Select **Connection type**.
  1. Under **Connection to PostgreSQL**, select **Managed Service for PostgreSQL** cluster as the connection type and specify the cluster you need.
  1. Under **Authentication**:
      1. Specify the **Username** you will use to connect to the cluster.
      1. Select the password setting method:
          * **Enter manually**: You set the password manually.
          * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
  1. Optionally, list the databases whose connections you want to manage. You can connect only to the databases that exist in the cluster. You must have [access to them configured](../../managed-postgresql/security/index.md).
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter. 


  To create a connection to a Managed Service for PostgreSQL cluster, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create postgresql --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create postgresql \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --managed-cluster-id <cluster_ID> \
        --databases <database_list>
      ```

      Where:

      * `--name`: Connection name.

      * `--description`: Connection description.

      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.

      * `--user`: Username to connect to the cluster.

      * `--password`: Password.
      
      * `--managed-cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](../../managed-postgresql/operations/cluster-list.md#list-clusters) in the folder.
      
      * `--databases`: Comma-separated list of databases. Make sure the user has the [required access permissions](../../managed-postgresql/security/index.md).


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a Managed Service for PostgreSQL cluster, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          postgresql = {
            managed_cluster_id = "<cluster_ID>"
            
            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.postgresql`: Parameters for connecting to the Managed Service for PostgreSQL cluster:

        * `managed_cluster_id`: Cluster ID.

          You can get the cluster ID with the [list of clusters](../../managed-postgresql/operations/cluster-list.md#list-clusters) in the folder.

        * `databases`: List of databases. Make sure the user has the [required access permissions](../../managed-postgresql/security/index.md).

        * `auth.user_password.user`: Username to connect to the cluster.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.    

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a Managed Service for PostgreSQL cluster, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method on the [Connection](../connection-manager/api-ref/grpc/Connection/index.md) resource.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 
 
  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.PostgreSQLConnection) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.PostgreSQLConnection) reference.

{% endlist %}

### Managed Service for ClickHouse® {#mdb-clickhouse}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
    1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
    1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
    1. Click **Create connection**.
    1. Specify the connection name.
    1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
    1. Select **Connection type**.
    1. Under **Connection to ClickHouse®**, select **Managed Service for ClickHouse®** cluster as the connection type and specify the cluster you need.
    1. Under **Authentication**:
        1. Specify the **Username** you will use to connect to the cluster.
        1. Select the password setting method:
            * **Enter manually**: You set the password manually.
            * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
    1. Optionally, list the databases whose connections you want to manage. You must have access to them configured.
    1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.


  To create a connection to a Managed Service for ClickHouse® cluster, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create clickhouse --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create clickhouse \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --managed-cluster-id <cluster_ID> \
        --databases <database_list>
      ```

      Where:

      * `--name`: Connection name.

      * `--description`: Connection description.

      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.

      * `--user`: Username to connect to the cluster.

      * `--password`: Password.
      
      * `--managed-cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](../../managed-clickhouse/operations/cluster-list.md#list-clusters) in the folder.
      
      * `--databases`: Comma-separated list of databases. Make sure the user has the [required access permissions](../../managed-clickhouse/security.md).


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a Managed Service for ClickHouse® cluster, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          clickhouse = {
            managed_cluster_id = "<cluster_ID>"
            
            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.clickhouse`: Parameters for connecting to the Managed Service for ClickHouse® cluster:

        * `managed_cluster_id`: Cluster ID.

          You can get the cluster ID with the [list of clusters](../../managed-clickhouse/operations/cluster-list.md#list-clusters) in the folder.

        * `databases`: List of databases. Make sure the user has the [required access permissions](../../managed-clickhouse/security.md).

        * `auth.user_password.user`: Username to connect to the cluster.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a Managed Service for ClickHouse® cluster, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection.  

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.ClickHouseConnection) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.ClickHouseConnection) reference.

{% endlist %}

### Managed Service for MySQL® {#mdb-mysql}

{% list tabs group=instructions %}

- Management console {#console}

   1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
   1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
   1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
   1. Click **Create connection**.
   1. Specify the connection name.
   1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
   1. Select **Connection type**.
   1. Under **Connection to MySQL®**, select **Managed Service for MySQL®** cluster as the connection type and specify the cluster you need.
   1. Under **Authentication**:
        1. Specify the **Username** you will use to connect to the cluster.
        1. Select the password setting method:
            * **Enter manually**: You set the password manually.
            * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
   1. Optionally, list the databases whose connections you want to manage. You can connect only to the databases that exist in the cluster. You must have [access to them configured](../../managed-mysql/security/index.md).
   1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a Managed Service for MySQL® cluster, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create mysql --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create mysql \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --managed-cluster-id <cluster_ID> \
        --databases <database_list>
      ```

      Where:

      * `--name`: Connection name.

      * `--description`: Connection description.

      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.

      * `--user`: Username to connect to the cluster.

      * `--password`: Password.
      
      * `--managed-cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](../../managed-mysql/operations/cluster-list.md#list-clusters) in the folder.
      
      * `--databases`: Comma-separated list of databases. Make sure the user has the [required access permissions](../../managed-mysql/security/index.md).


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a Managed Service for MySQL® cluster, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          mysql = {
            managed_cluster_id = "<cluster_ID>"
            
            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.mysql`: Parameters for connecting to the Managed Service for MySQL® cluster:

        * `managed_cluster_id`: Cluster ID.

          You can get the cluster ID with the [list of clusters](../../managed-mysql/operations/cluster-list.md#list-clusters) in the folder.

        * `databases`: List of databases. Make sure the user has the [required access permissions](../../managed-mysql/security/index.md).

        * `auth.user_password.user`: Username to connect to the cluster.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a Managed Service for MySQL® cluster, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.MySQLConnection) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.MySQLConnection) reference.

{% endlist %}

### Yandex Managed Service for Valkey™ {#mdb-valkey}

{% list tabs group=instructions %}

- Management console {#console}
    
    1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
    1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
    1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
    1. Click **Create connection**.
    1. Specify the connection name.
    1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
    1. From the **Connection type** list, select **Valkey™**.
    1. Under **Connection to Valkey™**, select **Yandex Managed Service for Valkey™** cluster as the connection type and specify the cluster you need.
    1. Under **Authentication**, select how to set the password:
         * **Enter manually**: Enter the password manually.
         * **Generate**: Specify the options to generate a [Lockbox](../../lockbox/quickstart.md) password automatically.
    1. Optionally, list the databases whose connections you want to manage. You must have access to them configured.
    1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a Yandex Managed Service for Valkey™ cluster, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create valkey --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create valkey \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --managed-cluster-id <cluster_ID> \
        --databases <database_list>
      ```

      Where:

      * `--name`: Connection name.

      * `--description`: Connection description.

      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.

      * `--user`: Username to connect to the cluster.

      * `--password`: Password.
      
      * `--managed-cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](../../managed-valkey/operations/cluster-list.md#list-clusters) in the folder.
      
      * `--databases`: Comma-separated list of databases. Make sure the user has the [required access permissions](../../managed-valkey/security/index.md).


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a Yandex Managed Service for Valkey™ cluster, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          valkey = {
            managed_cluster_id = "<cluster_ID>"
            
            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.valkey`: Parameters for connecting to the Yandex Managed Service for Valkey™ cluster:

        * `managed_cluster_id`: Cluster ID.

          You can get the cluster ID with the [list of clusters](../../managed-valkey/operations/cluster-list.md#list-clusters) in the folder.

        * `databases`: List of databases. Make sure the user has the [required access permissions](../../managed-valkey/security/index.md).

        * `auth.user_password.user`: Username to connect to the cluster.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a Yandex Managed Service for Valkey™ cluster, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.ValkeyConnection) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.ValkeyConnection) reference.

{% endlist %}

### Managed Service for OpenSearch {#mdb-opensearch}

{% list tabs group=instructions %}

- Management console {#console}

   1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
   1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
   1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
   1. Click **Create connection**.
   1. Specify the connection name.
   1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
   1. Select **Connection type**.
   1. Under **Connection to OpenSearch**, select **Managed Service for OpenSearch** cluster as the connection type and specify the cluster you need.
   1. Under **Authentication**:
        1. Specify the **Username** you will use to connect to the cluster.
        1. Select the password setting method:
            * **Enter manually**: You set the password manually.
            * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
   1. Optionally, list the databases whose connections you want to manage. You can connect only to the databases that exist in the cluster. You must have [access to them configured](../../managed-opensearch/security/index.md).
   1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a Managed Service for OpenSearch cluster, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create opensearch --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create opensearch \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --managed-cluster-id <cluster_ID>
      ```

      Where:

      * `--name`: Connection name.

      * `--description`: Connection description.

      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.

      * `--user`: Username to connect to the cluster.

      * `--password`: Password.
      
      * `--managed-cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](../../managed-opensearch/operations/cluster-list.md#list-clusters) in the folder.


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a Managed Service for OpenSearch cluster, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          opensearch = {
            managed_cluster_id = "<cluster_ID>"

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.opensearch`: Parameters for connecting to the Managed Service for OpenSearch cluster:

        * `managed_cluster_id`: Cluster ID.

          You can get the cluster ID with the [list of clusters](../../managed-opensearch/operations/cluster-list.md#list-clusters) in the folder.

        * `auth.user_password.user`: Username to connect to the cluster.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a Managed Service for OpenSearch cluster, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.OpenSearchConnection) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.OpenSearchConnection) reference.

{% endlist %}

### Yandex StoreDoc {#mdb-mongodb}

{% list tabs group=instructions %}

- Management console {#console}

   1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
   1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
   1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
   1. Click **Create connection**.
   1. Specify the connection name.
   1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
   1. Select **Connection type**.
   1. Under **Connection to MongoDB**, select **Yandex StoreDoc** cluster as the connection type and specify the cluster you need.
   1. Under **Authentication**:
        1. Specify the **Username** you will use to connect to the cluster.
        1. Select the password setting method:
            * **Enter manually**: You set the password manually.
            * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
   1. Optionally, list the databases whose connections you want to manage. You can connect only to the databases that exist in the cluster. You must have [access to them configured](../../storedoc/security/index.md).
   1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a Yandex StoreDoc cluster, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create mongodb --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create mongodb \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --managed-cluster-id <cluster_ID> \
        --databases <database_list>
      ```

      Where:

      * `--name`: Connection name.

      * `--description`: Connection description.

      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.

      * `--user`: Username to connect to the cluster.

      * `--password`: Password.
      
      * `--managed-cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](../../storedoc/operations/cluster-list.md#list-clusters) in the folder.
      
      * `--databases`: Comma-separated list of databases. Make sure the user has the [required access permissions](../../storedoc/security/index.md).


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a Yandex StoreDoc cluster, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          mongodb = {
            managed_cluster_id = "<cluster_ID>"
            
            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.mongodb`: Parameters for connecting to the Yandex StoreDoc cluster:

        * `managed_cluster_id`: Cluster ID.

          You can get the cluster ID with the [list of clusters](../../storedoc/operations/cluster-list.md#list-clusters) in the folder.

        * `databases`: List of databases. Make sure the user has the [required access permissions](../../storedoc/security/index.md).

        * `auth.user_password.user`: Username to connect to the cluster.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a Yandex StoreDoc cluster, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.MongoDBConnection) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.MongoDBConnection) reference.

{% endlist %}

### Managed Service for Apache Kafka® {#mdb-kafka}

{% list tabs group=instructions %}

- Management console {#console}

   1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
   1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
   1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
   1. Click **Create connection**.
   1. Specify the connection name.
   1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
   1. Select **Connection type**.
   1. Under **Connection to Apache Kafka®**, select **Managed Service for Kafka cluster** as the connection type and specify the cluster you need.
   1. When using authentication:

       * Specify the **Username** for the connection.
       * Set a password in one of the following ways:
         
         * **Enter manually**: Enter the password in the input field.
         * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
       
       * Optionally, in the **Authentication mechanisms** list, select the required options:
         
         * `PLAIN`: Authentication with login and password provided as plain unencrypted text.
         * `SCRAM_SHA256`: Authentication with SHA-256 hashing.
         * `SCRAM_SHA512`: Authentication with SHA-512 hashing.

         
   1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a Managed Service for Apache Kafka® cluster, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create kafka --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create kafka \
        --name <connection_name> \
        --description "<connection_description>" \
        --supported-mechanisms <list_of_authentication_mechanisms> \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --managed-cluster-id <cluster_ID>
      ```

      Where:

      * `--name`: Connection name.

      * `--description`: Connection description.

      * `--supported-mechanisms`: List of authentication mechanisms. The possible values are:
        
        * `PLAIN`: Authentication with login and password provided as plain unencrypted text.
        * `SCRAM_SHA256`: Authentication with SHA-256 hashing.
        * `SCRAM_SHA512`: Authentication with SHA-512 hashing.


      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.

      * `--user`: Username to connect to the cluster.

      * `--password`: Password.
      
      * `--managed-cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](../../managed-kafka/operations/cluster-list.md#list-clusters) in the folder.


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a Managed Service for Apache Kafka® cluster, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          kafka = {
            managed_cluster_id = "<cluster_ID>"

            auth = {
              sasl = {
                user     = "<username>"
                password = { 
                  raw = "<password>"
                }
                supported_mechanisms = [
                  <list_of_authentication_mechanisms>
                ]
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.kafka`: Parameters for connecting to the Managed Service for Apache Kafka® cluster:

        * `managed_cluster_id`: Cluster ID.

          You can get the cluster ID from the [folder’s cluster list](../../managed-kafka/operations/cluster-list.md#list-clusters).

        * `auth`: Authentication parameters. Select one of the sections:

          * `sasl`: SASL authentication parameters.
            
            * `user`: Username to connect to the cluster.
            * `password.raw`: Password.
            * `supported_mechanisms`: List of authentication mechanisms. The possible values are:
              
              * `PLAIN`: Authentication with login and password provided as plain unencrypted text.
              * `SCRAM_SHA256`: Authentication with SHA-256 hashing.
              * `SCRAM_SHA512`: Authentication with SHA-512 hashing.

          
          * `disabled`: Disables authentication.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a Managed Service for Apache Kafka® cluster, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method on the [Connection](../connection-manager/api-ref/grpc/Connection/index.md) resource.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection.  

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.KafkaConnection) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.KafkaConnection) reference.

{% endlist %}

### Yandex MPP Analytics for PostgreSQL {#mdb-greenplum}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
  1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
  1. Click **Create connection**.
  1. Specify the connection name.
  1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
  1. Select **Connection type**.
  1. Under **Connection to Greenplum**, select **Yandex MPP Analytics for PostgreSQL cluster** as the connection type and specify the cluster you need.
  1. Under **Authentication**:
      1. Specify the **Username** for the connection.
      1. Select the password setting method:
          * **Enter manually**: Enter the password in the input field.
          * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
  1. List the databases whose connections you want to manage. You can connect only to the databases that exist in the cluster. Make sure the user has the [required access permissions](../../managed-greenplum/security/index.md).
  
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a Yandex MPP Analytics for PostgreSQL cluster, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create greenplum --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create greenplum \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --managed-cluster-id <cluster_ID> \
        --databases <database_list>
      ```

      Where:

      * `--name`: Connection name.

      * `--description`: Connection description.

      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.

      * `--user`: Username to connect to the cluster.

      * `--password`: Password.
      
      * `--managed-cluster-id`: Cluster ID.

        You can get the cluster ID with the [list of clusters](../../managed-greenplum/operations/cluster-list.md#list-clusters) in the folder.
      
      * `--databases`: Comma-separated list of databases. Make sure the user has the [required access permissions](../../managed-greenplum/security/index.md).


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a Yandex MPP Analytics for PostgreSQL cluster, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          greenplum = {
            managed_cluster_id = "<cluster_ID>"
            
            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.greenplum`: Parameters for connecting to the Yandex MPP Analytics for PostgreSQL cluster:

        * `managed_cluster_id`: Cluster ID.

          You can get the cluster ID with the [list of clusters](../../managed-greenplum/operations/cluster-list.md#list-clusters) in the folder.

        * `databases`: List of databases. Make sure the user has the [required access permissions](../../managed-greenplum/security/index.md).

        * `auth.user_password.user`: Username to connect to the cluster.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a Yandex MPP Analytics for PostgreSQL cluster, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method on the [Connection](../connection-manager/api-ref/grpc/Connection/index.md) resource.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.GreenplumConnection) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.GreenplumConnection) reference.

{% endlist %}

## Connecting to a custom database installation {#on-premise-connection}

### PostgreSQL {#postgresql-on-premise}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
  1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
  1. Click **Create connection**.
  1. Specify the connection name.
  1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
  1. Select **Connection type**.
  1. Under **Connection to PostgreSQL**, specify the connection parameters:
      1. In the **Connection type** field, select **Custom installation**.
      1. In the **Hosts** field, specify the database host address and port number for the connection.

          When creating a connection to a custom database installation intended for [Yandex DataLens](../../datalens/concepts/index.md), specify the host's external address.

      1. Optionally, enable TLS.
          If your company has a certification authority (CA), the certificate issued by that CA will be used by default. If the company has no CA, upload the server's TLS certificate.
          
  1. Under **Authentication**:
      1. Specify the **Username** you will use to connect to the database.
      1. Select the password setting method:
          * **Enter manually**: You set the password manually.
          * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
  1. Optionally, list the databases whose connections you want to manage. You must have access to them configured.
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a custom PostgreSQL installation, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create postgresql --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create postgresql \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --hosts <list_of_hosts> \
        --databases <database_list> \
        --ca-certificate <path_to_certificate>
      ```

      Where:

      * `--name`: Connection name.
      
      * `--description`: Connection description.
      
      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.
      
      * `--user`: User name for connection to the database.
      
      * `--password`: Password.
            
      * `--hosts`: Comma-separated list of hosts in `<host>:<port>` format.
            
      * `--databases`: Comma-separated list of databases.
      
        Make sure the user has the required access permissions.
            
      * `--ca-certificate`: Path to your TLS CA certificate file.
            
        TLS is enabled by default; to disable it, use the `--tls-disabled` flag.


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a custom PostgreSQL installation, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          postgresql = {
            cluster = {
              hosts = [
                {
                  host = "<host_1>"
                  port = <port_1>
                },
                {
                  host = "<host_2>"
                  port = <port_2>
                },
                ...
                {
                  host = "<host_N>"
                  port = <port_N>
                }
              ]
              
              tls_params = {
                tls {
                  ca_certificate = "<path_to_certificate>"
                }
              }
            }

            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.postgresql`: Parameters for connecting to the custom PostgreSQL installation:
        
        * `cluster.hosts`: Host list. For each host, specify `host` and `port`.

        * `cluster.tls_params`: TLS parameters. Select one of the sections:
        
          * `tls.ca_certificate`: Path to your TLS CA certificate file.
          * `disabled`: Disables TLS. TLS is enabled by default.

        * `databases`: List of databases. Make sure the user has the required access permissions.

        * `auth.user_password.user`: User name for connection to the database.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a PostgreSQL custom installation, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection.  

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.PostgreSQLCluster) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.PostgreSQLCluster) reference.

{% endlist %}

### ClickHouse® {#clickhouse-on-premise}

{% list tabs group=instructions %}

- Management console {#console}

    1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
    1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
    1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
    1. Click **Create connection**.
    1. Specify the connection name.
    1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
    1. Select **Connection type**.
    1. Under **Connection to ClickHouse®**, specify the connection parameters:
        1. In the **Connection type** field, select **Custom installation**.
        1. In the **Hosts** field, specify the [FQDNs](../../managed-clickhouse/operations/connect/fqdn.md) or IP addresses of the hosts in the shard, HTTP or TCP port for connection, and the [shard](../../managed-clickhouse/operations/shards.md#list-shards) name.

            When creating a connection to a custom database installation intended for [Yandex DataLens](../../datalens/concepts/index.md), specify the hosts’ external IP addresses.

        1. Optionally, enable TLS.
            If your company has a certification authority (CA), the certificate issued by that CA will be used by default. If the company has no CA, upload the server's TLS certificate.
    1. Under **Authentication**:
        1. Specify the **Username** you will use to connect to the database.
        1. Select the password setting method:
            * **Enter manually**: You set the password manually.
            * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
    1. Optionally, list the databases whose connections you want to manage. You must have access to them configured.
    1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a custom ClickHouse® installation, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create clickhouse --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create clickhouse \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --hosts <list_of_hosts> \
        --databases <database_list> \
        --ca-certificate <path_to_certificate>
      ```

      Where:

      * `--name`: Connection name.
      
      * `--description`: Connection description.
      
      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.
      
      * `--user`: User name for connection to the database.
      
      * `--password`: Password.
      
      * `--hosts`: Comma-separated list of hosts in `<host>:<http_port>:<tcp_port>:<shard_name>` format.
      
      * `--databases`: Comma-separated list of databases.
      
        Make sure the user has the required access permissions.
        
      * `--ca-certificate`: Path to your TLS CA certificate file.
        
        TLS is enabled by default; to disable it, use the `--tls-disabled` flag.


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a custom ClickHouse® installation, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          clickhouse = {
            cluster = {
              hosts = [
                {
                  host       = "<host_1>"
                  http_port  = <http_port_1>
                  shard_name = "<shard_1_name>"
                  tcp_port   = <tcp_port_2>
                },
                {
                  host       = "<host_2>"
                  http_port  = <http_port_2>
                  shard_name = "<shard_2_name>"
                  tcp_port   = <tcp_port_2>
                },
                ...
                {
                  host       = "<host_N>"
                  http_port  = <http_port_N>
                  shard_name = "<shard_N_name>"
                  tcp_port   = <tcp_port_N>
                }
              ]
              
              tls_params = {
                tls {
                  ca_certificate = "<path_to_certificate>"
                }
              }
            }

            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.clickhouse`: Parameters for connecting to the custom ClickHouse® installation:
        
        * `cluster.hosts`: Host list. For each host, specify `host`, `http_port`, `shard_name`, and `tcp_port`.

        * `cluster.tls_params`: TLS parameters. Select one of the sections:
        
          * `tls.ca_certificate`: Path to your TLS CA certificate file.
          * `disabled`: Disables TLS. TLS is enabled by default.

        * `databases`: List of databases. Make sure the user has the required access permissions.

        * `auth.user_password.user`: User name for connection to the database.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a ClickHouse® custom installation, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.ClickHouseCluster) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.ClickHouseCluster) reference.

{% endlist %}

### MySQL® {#mysql-on-premise}

{% list tabs group=instructions %}

- Management console {#console}

   1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
   1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
   1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
   1. Click **Create connection**.
   1. Specify the connection name.
   1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
   1. Select **Connection type**.
   1. Under **Connection to MySQL®**, specify the connection parameters:
       1. In the **Connection type** field, select **Custom installation**.
       1. In the **Hosts** field, specify the database host address and port number for the connection.

           When creating a connection to a custom database installation intended for [Yandex DataLens](../../datalens/concepts/index.md), specify the host's external address.

       1. Optionally, enable TLS.
           If your company has a certification authority (CA), the certificate issued by that CA will be used by default. If the company has no CA, upload the server's TLS certificate.
           
   1. Under **Authentication**:
       1. Specify the **Username** you will use to connect to the database.
       1. Select the password setting method:
           * **Enter manually**: You set the password manually.
           * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
   1. Optionally, list the databases whose connections you want to manage. You must have access to them configured.
   1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a custom MySQL® installation, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create mysql --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create mysql \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --hosts <list_of_hosts> \
        --databases <database_list> \
        --ca-certificate <path_to_certificate>
      ```

      Where:

      * `--name`: Connection name.
      
      * `--description`: Connection description.
      
      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.
      
      * `--user`: User name for connection to the database.
      
      * `--password`: Password.
            
      * `--hosts`: Comma-separated list of hosts in `<host>:<port>` format.
            
      * `--databases`: Comma-separated list of databases.
      
        Make sure the user has the required access permissions.
            
      * `--ca-certificate`: Path to your TLS CA certificate file.
            
        TLS is enabled by default; to disable it, use the `--tls-disabled` flag.


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a custom MySQL® installation, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          mysql = {
            cluster = {
              hosts = [
                {
                  host = "<host_1>"
                  port = <port_1>
                },
                {
                  host = "<host_2>"
                  port = <port_2>
                },
                ...
                {
                  host = "<host_N>"
                  port = <port_N>
                }
              ]
              
              tls_params = {
                tls {
                  ca_certificate = "<path_to_certificate>"
                }
              }
            }

            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.mysql`: Parameters for connecting to the custom MySQL® installation:
        
        * `cluster.hosts`: Host list. For each host, specify `host` and `port`.

        * `cluster.tls_params`: TLS parameters. Select one of the sections:
        
          * `tls.ca_certificate`: Path to your TLS CA certificate file.
          * `disabled`: Disables TLS. TLS is enabled by default.

        * `databases`: List of databases. Make sure the user has the required access permissions.

        * `auth.user_password.user`: User name for connection to the database.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a MySQL® custom installation, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.MySQLCluster) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.MySQLCluster) reference.

{% endlist %}

### Valkey™ {#valkey-on-premise}

{% list tabs group=instructions %}

- Management console {#console}
    
    1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
    1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
    1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
    1. Click **Create connection**.
    1. Specify the connection name.
    1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
    1. From the **Connection type** list, select **Valkey™**.
    1. Under **Connection to Valkey™**, specify the connection parameters:
       1. In the **Connection type** field, select **Custom installation**.
       1. In the **Hosts** field, specify the [FQDNs](../../managed-valkey/operations/connect/index.md#fqdn) or IP addresses of the hosts in the shard, HTTP or TCP port for connection, and the shard name.
       1. Optionally, enable TLS.
    1. Under **Authentication**, specify a username and select how you want to set the password: 
        * **Enter manually**: Enter the password manually.
        * **Generate**: Specify the options to generate a [Lockbox](../../lockbox/quickstart.md) password automatically.
    1. Optionally, list the databases whose connections you want to manage. You must have access to them configured.
    1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a custom Valkey™ installation, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create redis --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create redis \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --hosts <list_of_hosts> \
        --databases <database_list> \
        --ca-certificate <path_to_certificate>
      ```

      Where:

      * `--name`: Connection name.
      
      * `--description`: Connection description.
      
      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.
      
      * `--user`: User name for connection to the database.
      
      * `--password`: Password.
      
      * `--hosts`: Comma-separated list of hosts in `<host>:<port>:<shard_name>` format.
      
      * `--databases`: Comma-separated list of databases.
      
        Make sure the user has the required access permissions.
        
      * `--ca-certificate`: Path to your TLS CA certificate file.
      
        TLS is enabled by default; to disable it, use the `--tls-disabled` flag.


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a custom Valkey™ installation, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          redis = {
            cluster = {
              hosts = [
                {
                  host       = "<host_1>"
                  port       = <port_1>
                  shard_name = "<shard_1_name>"
                },
                {
                  host       = "<host_2>"
                  port       = <port_2>
                  shard_name = "<shard_2_name>"
                },
                ...
                {
                  host       = "<host_N>"
                  port       = <port_N>
                  shard_name = "<shard_N_name>"
                }
              ]
              
              tls_params = {
                tls {
                  ca_certificate = "<path_to_certificate>"
                }
              }
            }

            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.redis`: Parameters for connecting to the custom Valkey™ installation:
        
        * `cluster.hosts`: Host list. For each host, specify `host`, `port`, and `shard_name`.

        * `cluster.tls_params`: TLS parameters. Select one of the sections:
        
          * `tls.ca_certificate`: Path to your TLS CA certificate file.
          * `disabled`: Disables TLS. TLS is enabled by default.

        * `databases`: List of databases. Make sure the user has the required access permissions.

        * `auth.user_password.user`: User name for connection to the database.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a Valkey™ custom installation, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.RedisCluster) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.RedisCluster) reference.

{% endlist %}

### Valkey™ {#valkey-on-premise}

{% list tabs group=instructions %}

- Management console {#console}
    
    1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
    1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
    1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
    1. Click **Create connection**.
    1. Specify the connection name.
    1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
    1. From the **Connection type** list, select **Valkey™**.
    1. Under **Connection to Valkey™**, specify the connection parameters:
       1. In the **Connection type** field, select **Custom installation**.
       1. In the **Hosts** field, specify the [FQDNs](../../managed-valkey/operations/connect/index.md#fqdn) or IP addresses of the hosts in the shard, HTTP or TCP port for connection, and the [shard](../../managed-valkey/operations/connect/sharded-code-examples.md) name.

           When creating a connection to a custom database installation intended for [Yandex DataLens](../../datalens/concepts/index.md), specify the hosts’ external IP addresses.

       1. Optionally, enable TLS.
    1. Under **Authentication**, specify a username and select how you want to set the password: 
        * **Enter manually**: Enter the password manually.
        * **Generate**: Specify the options to generate a [Lockbox](../../lockbox/quickstart.md) password automatically.
    1. Optionally, list the databases whose connections you want to manage. You must have access to them configured.
    1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a custom Valkey™ installation, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create valkey --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create valkey \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --hosts <list_of_hosts> \
        --databases <database_list> \
        --ca-certificate <path_to_certificate>
      ```

      Where:

      * `--name`: Connection name.
      
      * `--description`: Connection description.
      
      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.
      
      * `--user`: User name for connection to the database.
      
      * `--password`: Password.
            
      * `--hosts`: Comma-separated list of hosts in `<host>:<port>` format.
            
      * `--databases`: Comma-separated list of databases.
      
        Make sure the user has the required access permissions.
            
      * `--ca-certificate`: Path to your TLS CA certificate file.
            
        TLS is enabled by default; to disable it, use the `--tls-disabled` flag.


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a custom Valkey™ installation, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          valkey = {
            cluster = {
              hosts = [
                {
                  host = "<host_1>"
                  port = <port_1>
                },
                {
                  host = "<host_2>"
                  port = <port_2>
                },
                ...
                {
                  host = "<host_N>"
                  port = <port_N>
                }
              ]
              
              tls_params = {
                tls {
                  ca_certificate = "<path_to_certificate>"
                }
              }
            }

            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.valkey`: Parameters for connecting to the custom Valkey™ installation:
        
        * `cluster.hosts`: Host list. For each host, specify `host` and `port`.

        * `cluster.tls_params`: TLS parameters. Select one of the sections:
        
          * `tls.ca_certificate`: Path to your TLS CA certificate file.
          * `disabled`: Disables TLS. TLS is enabled by default.

        * `databases`: List of databases. Make sure the user has the required access permissions.

        * `auth.user_password.user`: User name for connection to the database.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a Valkey™ custom installation, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.ValkeyCluster) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.ValkeyCluster) reference.

{% endlist %}

### Trino {#trino-on-premise}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
  1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
  1. Click **Create connection**.
  1. Specify the connection name.
  1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
  1. Select **Connection type**.
  1. Under **Connection to Trino**, specify the connection parameters:
      1. In the **Coordinator** field, specify the [coordinator](https://trino.io/docs/current/overview/concepts.html#coordinator) host address and port number for the connection. 
      1. Optionally, enable TLS.
          If your company has a certification authority (CA), the certificate issued by that CA will be used by default. If the company has no CA, upload the server's TLS certificate.
  1. Under **Authentication**:
      1. Specify the **Username** you will use to connect to the database.
      1. Select the password setting method:
          * **Enter manually**: You set the password manually.
          * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a custom Trino installation, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create trino --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create trino \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --coordinator <coordinator_parameters> \
        --ca-certificate <path_to_certificate>
      ```

      Where:

      * `--name`: Connection name.
      
      * `--description`: Connection description.
      
      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.
      
      * `--user`: User name for connection to the database.
      
      * `--password`: Password.
      
      * `--coordinator`: Coordinator parameters in `<host>:<port>` format.
      
      * `--ca-certificate`: Path to your TLS CA certificate file.
      
        TLS is enabled by default; to disable it, use the `--tls-disabled` flag.


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a custom Trino installation, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          trino = {
            cluster = {
              coordinator = {
                  host = "<host>"
                  port = <port>
              }
              
              tls_params = {
                tls {
                  ca_certificate = "<path_to_certificate>"
                }
              }
            }

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.trino`: Parameters for connecting to the custom Trino installation:
        
        * `cluster.coordinator`: Coordinator parameters, `host` and `port`.

        * `cluster.tls_params`: TLS parameters. Select one of the sections:
        
          * `tls.ca_certificate`: Path to your TLS CA certificate file.
          * `disabled`: Disables TLS. TLS is enabled by default.

        * `auth.user_password.user`: User name for connection to the database.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a Trino custom installation, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection.  

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.TrinoCluster) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.TrinoCluster) reference.

{% endlist %}

### OpenSearch {#opensearch-on-premise}

{% list tabs group=instructions %}

- Management console {#console}

   1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
   1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
   1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
   1. Click **Create connection**.
   1. Specify the connection name.
   1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
   1. Select **Connection type**.
   1. Under **Connection to OpenSearch**, specify the connection parameters:
       1. In the **Connection type** field, select **Custom installation**.
       1. In the **Hosts** field, specify the database host address and port number for the connection.
       1. Optionally, enable TLS.
           If your company has a certification authority (CA), the certificate issued by that CA will be used by default. If the company has no CA, upload the server's TLS certificate.
   1. Under **Authentication**:
       1. Specify the **Username** you will use to connect to the database.
       1. Select the password setting method:
           * **Enter manually**: You set the password manually.
           * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
   1. Optionally, list the databases whose connections you want to manage. You must have access to them configured.
   1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a custom OpenSearch installation, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create opensearch --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create opensearch \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --hosts <list_of_hosts> \
        --ca-certificate <path_to_certificate>
      ```

      Where:

      * `--name`: Connection name.
      
      * `--description`: Connection description.
      
      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.
      
      * `--user`: User name for connection to the database.
      
      * `--password`: Password.
      
      * `--hosts`: Comma-separated list of hosts in `<host>:<port>` format.
      
      * `--ca-certificate`: Path to your TLS CA certificate file.
      
        TLS is enabled by default; to disable it, use the `--tls-disabled` flag.


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a custom OpenSearch installation, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          opensearch = {
            cluster = {
              hosts = [
                {
                  host = "<host_1>"
                  port = <port_1>
                },
                {
                  host = "<host_2>"
                  port = <port_2>
                },
                ...
                {
                  host = "<host_N>"
                  port = <port_N>
                }
              ]
              
              tls_params = {
                tls {
                  ca_certificate = "<path_to_certificate>"
                }
              }
            }

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.opensearch`: Parameters for connecting to the custom OpenSearch installation:
        
        * `cluster.hosts`: Host list. For each host, specify `host` and `port`.

        * `cluster.tls_params`: TLS parameters. Select one of the sections:
        
          * `tls.ca_certificate`: Path to your TLS CA certificate file.
          * `disabled`: Disables TLS. TLS is enabled by default.

        * `auth.user_password.user`: User name for connection to the database.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a OpenSearch custom installation, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.OpenSearchCluster) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.OpenSearchCluster) reference.

{% endlist %}

### MongoDB {#mongodb-on-premise}

{% list tabs group=instructions %}

- Management console {#console}

   1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
   1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
   1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
   1. Click **Create connection**.
   1. Specify the connection name.
   1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
   1. Select **Connection type**.
   1. Under **Connection to MongoDB**, specify the connection parameters:
       1. In the **Connection type** field, select **Custom installation**.
       1. In the **Hosts** field, specify the database host address and port number for the connection.
       1. Optionally, enable TLS. 
           If your company has a certification authority (CA), the certificate issued by that CA will be used by default. If the company has no CA, upload the server's TLS certificate.
   1. Under **Authentication**:
       1. Specify the **Username** you will use to connect to the database.
       1. Select the password setting method:
           * **Enter manually**: You set the password manually.
           * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
   1. Optionally, list the databases whose connections you want to manage. You must have access to them configured.
   1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a custom MongoDB installation, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create mongodb --help
      ```
      
  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create mongodb \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --hosts <list_of_hosts> \
        --databases <database_list> \
        --ca-certificate <path_to_certificate>
      ```

      Where:

      * `--name`: Connection name.
      
      * `--description`: Connection description.
      
      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.
      
      * `--user`: User name for connection to the database.
      
      * `--password`: Password.
            
      * `--hosts`: Comma-separated list of hosts in `<host>:<port>` format.
            
      * `--databases`: Comma-separated list of databases.
      
        Make sure the user has the required access permissions.
            
      * `--ca-certificate`: Path to your TLS CA certificate file.
            
        TLS is enabled by default; to disable it, use the `--tls-disabled` flag.


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a custom MongoDB installation, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          mongodb = {
            cluster = {
              hosts = [
                {
                  host = "<host_1>"
                  port = <port_1>
                },
                {
                  host = "<host_2>"
                  port = <port_2>
                },
                ...
                {
                  host = "<host_N>"
                  port = <port_N>
                }
              ]
              
              tls_params = {
                tls {
                  ca_certificate = "<path_to_certificate>"
                }
              }
            }

            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.mongodb`: Parameters for connecting to the custom MongoDB installation:
        
        * `cluster.hosts`: Host list. For each host, specify `host` and `port`.

        * `cluster.tls_params`: TLS parameters. Select one of the sections:
        
          * `tls.ca_certificate`: Path to your TLS CA certificate file.
          * `disabled`: Disables TLS. TLS is enabled by default.

        * `databases`: List of databases. Make sure the user has the required access permissions.

        * `auth.user_password.user`: User name for connection to the database.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a MongoDB custom installation, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.MongoDBCluster) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.MongoDBCluste) reference.

{% endlist %}

### Apache Kafka® {#kafka-on-premise}

{% list tabs group=instructions %}

- Management console {#console}

   1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
   1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
   1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
   1. Click **Create connection**.
   1. Specify the connection name.
   1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
   1. Select **Connection type**.
   1. Under **Connection to Apache Kafka®**, specify the connection parameters:
       
       * In the **Connection type** list, select **Custom installation**.
       * In the **Hosts** field, specify the host address and port for the connection.
       * Optionally, enable TLS.
           
           If your company has a certification authority (CA), the certificate issued by that CA will be used by default. If the company has no CA, upload the server's TLS certificate.
   
   1. When using authentication:

       * Specify the **Username** for the connection.
       * Set a password in one of the following ways:
         
         * **Enter manually**: Enter the password in the input field.
         * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
       
       * Optionally, in the **Authentication mechanisms** list, select the required options:
         
         * `PLAIN`: Authentication with login and password provided as plain unencrypted text.
         * `SCRAM_SHA256`: Authentication with SHA-256 hashing.
         * `SCRAM_SHA512`: Authentication with SHA-512 hashing.


   1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a custom Apache Kafka® installation, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create kafka --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create kafka \
        --name <connection_name> \
        --description "<connection_description>" \
        --supported-mechanisms <list_of_authentication_mechanisms> \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --hosts <list_of_hosts> \
        --ca-certificate <path_to_certificate>
      ```

      Where:

      * `--name`: Connection name.

      * `--description`: Connection description.

      * `--supported-mechanisms`: List of authentication mechanisms. The possible values are:
        
        * `PLAIN`: Authentication with login and password provided as plain unencrypted text.
        * `SCRAM_SHA256`: Authentication with SHA-256 hashing.
        * `SCRAM_SHA512`: Authentication with SHA-512 hashing.


      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.

      * `--user`: Username to connect to the cluster.

      * `--password`: Password.
      
      * `--hosts`: Comma-separated list of hosts in `<host>:<port>` format.
      
      * `--ca-certificate`: Path to your TLS CA certificate file.
        
        TLS is enabled by default; to disable it, use the `--tls-disabled` flag.


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a custom Apache Kafka® installation, do the following:

  1. In the configuration file, describe the resource you are creating:
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          kafka = {
            cluster = {
              hosts = [
                {
                  host = "<host_1>"
                  port = <port_1>
                },
                {
                  host = "<host_2>"
                  port = <port_2>
                },
                ...
                {
                  host = "<host_N>"
                  port = <port_N>
                }
              ]
              
              tls_params = {
                tls {
                  ca_certificate = "<path_to_certificate>"
                }
              }
            }

            auth = {
              sasl = {
                user     = "<username>"
                password = { 
                  raw = "<password>"
                }
                supported_mechanisms = [
                  <list_of_authentication_mechanisms>
                ]
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.kafka`: Parameters for connecting to the custom Apache Kafka® installation:
        
        * `cluster.hosts`: Host list. For each host, specify `host` and `port`.

        * `cluster.tls_params`: TLS parameters. Select one of the sections:
        
          * `tls.ca_certificate`: Path to your TLS CA certificate file.
          * `disabled`: Disables TLS. TLS is enabled by default.

        * `auth`: Authentication parameters. Select one of the sections:

          * `sasl`: SASL authentication parameters.
            
            * `user`: Username to connect to the cluster.
            * `password.raw`: Password.
            * `supported_mechanisms`: List of authentication mechanisms. The possible values are:
              
              * `PLAIN`: Authentication with login and password provided as plain unencrypted text.
              * `SCRAM_SHA256`: Authentication with SHA-256 hashing.
              * `SCRAM_SHA512`: Authentication with SHA-512 hashing.

          
          * `disabled`: Disables authentication.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a Apache Kafka® custom installation, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.KafkaCluster) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.KafkaCluster) reference.

{% endlist %}

### Greenplum® {#greenplum-on-premise}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to create a connection in.
  1. [Navigate](../../console/operations/select-service.md#select-service) to **Yandex MetaData Hub**.
  1. In the left-hand panel, select ![image](../../_assets/console-icons/plug-connection.svg) **Connection manager**.
  1. Click **Create connection**.
  1. Specify the connection name.
  1. Optionally, add a description and [label](../../resource-manager/concepts/labels.md) for the connection.
  1. Select **Connection type**.
  1. Under **Connection to Greenplum**, specify the connection parameters:
      1. In the **Connection type** field, select **Custom installation**.
      1. In the **Hosts** field, specify the database host address and port number for the connection.

          When creating a connection to a custom database installation intended for [Yandex DataLens](../../datalens/concepts/index.md), specify the host's external address.

      1. Optionally, enable TLS.
          
          If your company has a certification authority (CA), the certificate issued by that CA will be used by default. If the company has no CA, upload the server's TLS certificate.
          
  1. Under **Authentication**:
      1. Specify the **Username** for the connection.
      1. Select the password setting method:
          * **Enter manually**: Enter the password in the input field.
          * **Generate**: Password will be generated automatically. You can configure [Lockbox](../../lockbox/quickstart.md) password generation rules or leave the default ones.
  1. List the databases whose connections you want to manage. Make sure the user has the required access permissions.
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify its ID in the `--secret-folder-id` option. You need the `resource-manager.user` role for the target folder to do this. The folders for the connection and the secret must be located within the same cloud. After creating the connection, you cannot change this parameter.

  To create a connection to a custom Greenplum® installation, do the following:

  1. See the description of the CLI command for creating a connection:

      ```bash
      yc metadata-hub connection-manager connection create greenplum --help
      ```

  1. Create your connection by running this command:
      
      ```bash
      yc metadata-hub connection-manager connection create greenplum \
        --name <connection_name> \
        --description "<connection_description>" \
        --labels <label_list> \
        --user <username> \
        --password <password> \
        --hosts <list_of_hosts> \
        --databases <database_list> \
        --ca-certificate <path_to_certificate>
      ```

      Where:

      * `--name`: Connection name.
      
      * `--description`: Connection description.
      
      * `--labels`: Comma-separated list of labels in `"<key>":"<value>"` format.
      
      * `--user`: User name for connection to the database.
      
      * `--password`: Password.
            
      * `--hosts`: Comma-separated list of hosts in `<host>:<port>` format.
            
      * `--databases`: Comma-separated list of databases.
      
        Make sure the user has the required access permissions.
            
      * `--ca-certificate`: Path to your TLS CA certificate file.
            
        TLS is enabled by default; to disable it, use the `--tls-disabled` flag.


- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To create a connection to a custom Greenplum® installation, do the following:

  1. In the configuration file, describe the resource you are creating.
  
      Here is an example of the configuration file structure:
  
      ```hcl
      resource "yandex_connectionmanager_connection" "<local_connection_name>" {
        name        = "<connection_name>"
        description = "<connection_description>"
        
        labels = {
          "<key_1>" = "<value_1>"
          "<key_2>" = "<value_2>"
          ...
          "<key_N>" = "<value_N>"
        }
        
        params = {
          greenplum = {
            cluster = {
              hosts = [
                {
                  host = "<host_1>"
                  port = <port_1>
                },
                {
                  host = "<host_2>"
                  port = <port_2>
                },
                ...
                {
                  host = "<host_N>"
                  port = <port_N>
                }
              ]
              
              tls_params = {
                tls {
                  ca_certificate = "<path_to_certificate>"
                }
              }
            }

            databases = [
              "<database_1>",
              "<database_2>",
              ...
              "<database_N>"
            ]

            auth = {
              user_password = {
                user     = "<username>"
                password = {
                  raw = "<password>"
                }
              }
            }
          }
        }
      }
      ```

      Where:

      * `name`: Connection name.

      * `description`: Connection description.

      * `--labels`: Labels in `"<key>" = "<value>"` format.

      * `params.greenplum`: Parameters for connecting to the custom Greenplum® installation:
        
        * `cluster.hosts`: Host list. For each host, specify `host` and `port`.

        * `cluster.tls_params`: TLS parameters. Select one of the sections:
        
          * `tls.ca_certificate`: Path to your TLS CA certificate file.
          * `disabled`: Disables TLS. TLS is enabled by default.

        * `databases`: List of databases. Make sure the user has the required access permissions.

        * `auth.user_password.user`: User name for connection to the database.

        * `auth.user_password.password.raw`: Password.


  1. Optionally, to create a secret in a specific folder, specify its ID in the `lockbox_secret_spec` option. You need the `resource-manager.user` role for the target folder to do this. Both the connection folder and the secret folder must reside within the same cloud. You cannot change this parameter after you create the connection. If the parameter is not specified, the secret is created in the same folder as the connection.  

  1. Make sure the settings are correct.
  
      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.
  
  1. Confirm resource changes.
  
      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.
  
  For more information, see [this Terraform provider guide](https://terraform-provider.yandexcloud.net/resources/connectionmanager_connection).


- API {#api}

  To create a connection to a MongoDB custom installation, use the [Connection.Create](../connection-manager/api-ref/Connection/create.md) REST API method or the [ConnectionService.Create](../connection-manager/api-ref/grpc/Connection/create.md) gRPC API method.

  By default, secrets are created in the same folder as connections. To create a secret in a different folder, specify the folder ID in `lockboxSecretSpec`. You will need the `resource-manager.user` role for the target folder. The folders for the connection and the secret must be located within the same cloud. You cannot change this parameter after you create the connection. 

  For more information about the available request parameters, see the [REST API](../connection-manager/api-ref/Connection/create.md#yandex.cloud.connectionmanager.v1.GreenplumCluster) and [gRPC API](../connection-manager/api-ref/grpc/Connection/create.md#yandex.cloud.connectionmanager.v1.GreenplumCluster) reference.

{% endlist %}

_ClickHouse® is a registered trademark of [ClickHouse, Inc](https://clickhouse.com)._