[Yandex Cloud documentation](../../index.md) > [Yandex MetaData Hub](../index.md) > Connection Manager > Service roles for access management

# Service roles for managing connections using Yandex Connection Manager


With Yandex Connection Manager service roles, you can view non-secret connection data and manage connections. You can view secret connection data, such as DB passwords, in [Yandex Lockbox](../../lockbox/index.md). To do this, you will also need the `lockbox.payloadViewer` [role](../../lockbox/security/index.md#lockbox-payloadViewer).

```mermaid
%%{
  init: {
    "flowchart": { "defaultRenderer": "elk" },
    "elk": { "nodePlacementStrategy": "SIMPLE" }
  }
}%%
flowchart BT
    connection-manager.auditor["`connection-manager.
    auditor`"] --> connection-manager.viewer
    connection-manager.viewer --> connection-manager.editor
    connection-manager.editor --> connection-manager.admin
    connection-manager.user --> connection-manager.editor
```

### connection-manager.auditor {#connection-manager-auditor}

The `connection-manager.auditor` role allows you to view public details on [connections](../concepts/connection-manager.md) and [access permissions](../../iam/concepts/access-control/index.md) assigned to them. If you have this role assigned for a cloud, it will also enable viewing Connection Manager [quotas](../concepts/limits.md).

### connection-manager.viewer {#connection-manager-viewer}

The `connection-manager.viewer` role enables viewing info on [connections](../concepts/connection-manager.md) and [access permissions](../../iam/concepts/access-control/index.md) assigned to them, as well as on the Connection Manager [quotas](../concepts/limits.md).

This role includes the `connection-manager.auditor` permissions.


### connection-manager.editor {#connection-manager-editor}

The `connection-manager.editor` role allows you to manage connections and view their details.

Users with this role can:
* Create, use, edit, and delete [connections](../concepts/connection-manager.md).
* View connection details and info on connection [access permissions](../../iam/concepts/access-control/index.md).
* View info on Connection Manager [quotas](../concepts/limits.md).

This role includes the `connection-manager.viewer` permissions.

### connection-manager.admin {#connection-manager-admin}

The `connection-manager.admin` role allows you to manage connections and access to those, as well as view connection details.

Users with this role can:
* Create, use, edit, and delete [connections](../concepts/connection-manager.md), as well as manage access to them.
* View connection details and info on connection [access permissions](../../iam/concepts/access-control/index.md).
* View info on Connection Manager [quotas](../concepts/limits.md).

This role includes the `connection-manager.editor` permissions.

### connection-manager.user {#connection-manager-user}

The `connection-manager.user` role enables using [connections](../concepts/connection-manager.md) in the resources of other cloud services integrated with Connection Manager, e.g., in Data Transfer, DataLens, WebSQL, etc.


## Required roles {#choosing-roles}

The table below lists the roles required for specific actions. You can always assign a role with more permissions, e.g., `editor` instead of `viewer`.

| Action                                                      | Required roles                     |
|---------------------------------------------------------------|--------------------------------------|
| Getting information about connections                            | `connection-manager.viewer`          |
| Getting a list of connections                                   | `connection-manager.viewer`          | 
| Creating a connection                                           | `connection-manager.editor`          | 
| Editing a connection                                          | `connection-manager.editor`          |
| Deleting a connection                                           | `connection-manager.editor`          |
| Setting connection access permissions                        | `connection-manager.admin`           |
| Changing connection access permissions                          | `connection-manager.admin`           |