[Yandex Cloud documentation](../../index.md) > [Yandex MetaData Hub](../index.md) > Apache Hive™ Metastore > Service roles for access management

# Service roles to manage metadata in a Apache Hive™ Metastore cluster

With Apache Hive™ Metastore service roles, you can view Apache Hive™ Metastore cluster metadata and manage clusters.

```mermaid
%%{
  init: {
    "flowchart": { "defaultRenderer": "elk" },
    "elk": { "nodePlacementStrategy": "SIMPLE" }
  }
}%%
flowchart BT
    managed-metastore.auditor --> managed-metastore.viewer
    managed-metastore.maintenanceTask.viewer --> managed-metastore.maintenanceTask.editor["`managed-metastore.
    maintenanceTask.editor`"]
    managed-metastore.maintenanceTask.viewer["`managed-metastore.
    maintenanceTask.viewer`"] --> managed-metastore.viewer
    managed-metastore.viewer --> managed-metastore.editor
    managed-metastore.editor --> managed-metastore.admin
    managed-metastore.maintenanceTask.editor["`managed-metastore.
    maintenanceTask.editor`"] --> managed-metastore.editor
    managed-metastore.integrationProvider["`managed-metastore.
    integrationProvider`"]
```

## managed-metastore.maintenanceTask.viewer {#managed-metastore-maintenanceTask-viewer}

The `managed-metastore.maintenanceTask.viewer` role enables viewing info on [Apache Hive™ Metastore clusters](../concepts/metastore.md), [access permissions](../../iam/concepts/access-control/index.md) granted for them, their maintenance tasks, and on the quotas for Yandex Cloud managed DB services.

## managed-metastore.maintenanceTask.editor {#managed-metastore-maintenanceTask-editor}

The `managed-metastore.maintenanceTask.editor` role enables viewing info on maintenance tasks for [Apache Hive™ Metastore clusters](../concepts/metastore.md) and modifying such tasks, as well as viewing info on Apache Hive™ Metastore clusters, on [access permissions](../../iam/concepts/access-control/index.md) granted for them, and on the quotas for Yandex Cloud managed DB services.

This role includes the `managed-metastore.maintenanceTask.viewer` permissions.

## managed-metastore.auditor {#managed-metastore-auditor}

The `managed-metastore.auditor` role allows you to view information on Apache Hive™ Metastore [clusters](../concepts/metastore.md) and the Yandex Cloud managed DB service quotas.

## managed-metastore.viewer {#managed-metastore-viewer}

The `managed-metastore.viewer` role enables viewing info on Apache Hive™ Metastore clusters and their runtime logs, as well as info on the quotas for Yandex Cloud managed DB services.

Users with this role can:
* View info on Apache Hive™ Metastore [clusters](../concepts/metastore.md).
* View info on [access permissions](../../iam/concepts/access-control/index.md) granted for Apache Hive™ Metastore clusters.
* View info on maintenance tasks for Apache Hive™ Metastore clusters.
* View Apache Hive™ Metastore cluster logs.
* View info on the quotas for Yandex Cloud managed DB services.
* View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud) and [folder](../../resource-manager/concepts/resources-hierarchy.md#folder).

This role includes the `managed-metastore.auditor` and `managed-metastore.maintenanceTask.viewer` permissions.

## managed-metastore.editor {#managed-metastore-editor}

The `managed-metastore.editor` role enables managing Apache Hive™ Metastore clusters, as well as viewing their runtime logs and info on the quotas for Yandex Cloud managed DB services.

Users with this role can:
* View info on Apache Hive™ Metastore [clusters](../concepts/metastore.md), as well as create, modify, run, stop, and delete them.
* [Export and import](../operations/metastore/export-and-import.md) Apache Hive™ Metastore clusters.
* View Apache Hive™ Metastore cluster logs.
* View info on [access permissions](../../iam/concepts/access-control/index.md) granted for Apache Hive™ Metastore clusters.
* View info on maintenance tasks for Apache Hive™ Metastore clusters and modify such tasks.
* View info on the quotas for Yandex Cloud managed DB services.
* View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud) and [folder](../../resource-manager/concepts/resources-hierarchy.md#folder).

This role includes the `managed-metastore.viewer` and `managed-metastore.maintenanceTask.editor` permissions.

To create clusters, you also need the `vpc.user` [role](../../vpc/security/index.md#vpc-user).

## managed-metastore.admin {#managed-metastore-admin}

The `managed-metastore.admin` role allows you to manage Apache Hive™ Metastore clusters, as well as view their runtime logs and information on service quotas of Yandex Cloud managed DBs.

Users with this role can:
* View info on Apache Hive™ Metastore [clusters](../concepts/metastore.md), as well as create, modify, run, stop, and delete them.
* [Export and import](../operations/metastore/export-and-import.md) Apache Hive™ Metastore clusters.
* View Apache Hive™ Metastore cluster logs.
* View info on the Yandex Cloud managed DB service quotas.
* View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud) and [folder](../../resource-manager/concepts/resources-hierarchy.md#folder).

This role includes the `managed-metastore.editor` permissions.

To create clusters, you also need the `vpc.user` [role](../../vpc/security/index.md#vpc-user).

## managed-metastore.integrationProvider {#managed-metastore-integrationProvider}

The `managed-metastore.integrationProvider` role allows the Apache Hive™ Metastore cluster to work with user resources required for its operation on behalf of the service account. You can assign this role to a service account linked to a Apache Hive™ Metastore cluster.

Users with this role can:
* Add entries to [log groups](../../logging/concepts/log-group.md).
* View info on log groups.
* View info on log sinks.
* View info on granted [access permissions](../../iam/concepts/access-control/index.md) for Cloud Logging resources.
* View info on log exports.
* View info on Monitoring [metrics](../../monitoring/concepts/data-model.md#metric) and their [labels](../../monitoring/concepts/data-model.md#label), as well as upload and download metrics.
* View the list of Monitoring [dashboards](../../monitoring/concepts/visualization/dashboard.md) and [widgets](../../monitoring/concepts/visualization/widget.md) and info on them, as well as create, modify, and delete them.
* View the Monitoring [notification](../../monitoring/concepts/alerting/notification-channel.md) history.
* View details on [Monitoring](../../monitoring/concepts/limits.md#monitoring-quotas) quotas.
* View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud) and [folder](../../resource-manager/concepts/resources-hierarchy.md#folder).

This role includes the `logging.writer` and `monitoring.editor` permissions.

_Apache® and [Apache Hive™](https://hive.apache.org/) are either registered trademarks or trademarks of the Apache Software Foundation in the United States and/or other countries._