[Yandex Cloud documentation](../../../index.md) > [Yandex Cloud Stackland](../../index.md) > [Step-by-step guides](../index.md) > Databases > Iceberg REST Catalog > Creating a catalog user

# Creating a catalog user

A [Iceberg REST Catalog catalog](../../concepts/components/rest-catalog.md) user is an account with OAuth2 access. Create a user in a project with an existing catalog.

{% list tabs group=instructions %}

- CLI {#cli}

  1. Create the `RestCatalogPrincipal` resource file, e.g., using the `touch restcatalogprincipal.yaml` command.
  1. Open the file and paste the configuration below into it. Along with the user, create an OAuth2 credentials secret:

      ```yaml
      apiVersion: restcatalog.stackland.yandex.cloud/v1alpha1
      kind: RestCatalogPrincipal
      metadata:
        name: analytics-service-account    # Catalog user name; unique within the cluster
      spec:
        catalog: analytics                 # Catalog (RestCatalog.metadata.name) name in the same project
        principalRoles:                    # Names of user groups from the catalog's declaredPrincipalRoles
          - analytics-admin
        credentialsSecretRef:
          name: analytics-principal-credentials   # Link to secret with OAuth2 credentials
      ---
      apiVersion: v1
      kind: Secret
      metadata:
        name: analytics-principal-credentials
      type: Opaque
      stringData:
        clientId: analytics-service-account       # Matches the catalog user name
        clientSecret: <client_secret>            # Set by administrator
      ```

      Follow these requirements:

      * `spec.catalog` must refer to an existing catalog named `RestCatalog` in the same project.
      * The names in `spec.principalRoles` must be on the `spec.declaredPrincipalRoles` list of user groups of that catalog.

  1. Apply the manifest: `kubectl apply -f restcatalogprincipal.yaml -n <project_name>`. Optionally, you can specify the project name in the `metadata.namespace` resource property and skip it in the command.


- Management console {#console}

  1. If you have not opened a project yet, select one.
  1. In the left-hand menu, select **Iceberg REST Catalog**.
  1. In the **Catalogs** tab, select the catalog.
  1. Go to the **Users** tab.
  1. Click **Create user**.
  1. Fill out the fields as follows:

      * **Name**: Catalog user name. Once created, the name never changes.
      * **Client ID**: Matches the user name and cannot be changed.
      * **Client secret**: Specify the OAuth2 secret.
      * **List of roles**: Select one or more catalog user groups.

  1. Click **Create**.

{% endlist %}