[Yandex Cloud documentation](../../index.md) > [Tutorials](../index.md) > [Building a data platform](index.md) > Configuring permissions for access to a secret created by Connection Manager for a Managed Service for PostgreSQL user

# Configuring permissions for access to a secret created by Yandex Connection Manager for a Yandex Managed Service for PostgreSQL user

# Configuring permissions for access to a secret created by Yandex Connection Manager for a Yandex Managed Service for PostgreSQL user

You can get a [Yandex Managed Service for PostgreSQL](../../managed-postgresql/index.md) user's password from the [Yandex Lockbox secret](../../lockbox/concepts/secret.md). You can do it via the [Yandex Cloud CLI](../../cli/index.md). Do it by permitting the [service account](../../iam/concepts/users/service-accounts.md) you are using to log in to the Yandex Cloud CLI to access the user's secret. You can get the secret-related information you need to configure the permissions from the [Connection Manager](../../metadata-hub/concepts/connection-manager.md) connection.

To configure permissions for access to a user's secret:

1. [Create the required infrastructure and configure permissions for access to the user's secret](#set-up-roles).
1. [Get the user password from the secret](#get-password).

If you no longer need the resources you created, [delete them](#clear-out).

## Getting started {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md).


### Required paid resources {#paid-resources}

* Managed Service for PostgreSQL cluster: use of computing resources allocated to hosts, as well as the storage and backup size (see [Managed Service for PostgreSQL pricing](../../managed-postgresql/pricing.md)).
* Public IP addresses if public access is enabled for cluster hosts (see [Yandex Virtual Private Cloud pricing](../../vpc/pricing.md)).

Connection Manager and the secrets created with it are free of charge.


## Configure permissions for access to a Managed Service for PostgreSQL user's secret {#set-up-roles}

{% list tabs group=instructions %}

- Terraform {#tf}

    1. If you do not have Terraform yet, [install it](../infrastructure-management/terraform-quickstart.md#install-terraform).
    1. [Get the authentication credentials](../infrastructure-management/terraform-quickstart.md#get-credentials). You can add them to environment variables or specify them later in the provider configuration file.
    1. [Configure and initialize a provider](../infrastructure-management/terraform-quickstart.md#configure-provider). There is no need to create a provider configuration file manually, you can [download it](https://github.com/yandex-cloud-examples/yc-terraform-provider-settings/blob/main/provider.tf).

        {% note warning %}
        
        Requires Yandex provider version `0.160.0` or higher. If the provider version is not explicitly specified in the configuration, Terraform will automatically download the latest compatible version.

        {% endnote %}

    1. Place the configuration file in a separate working directory and [specify the parameter values](../infrastructure-management/terraform-quickstart.md#configure-provider). If you did not add the authentication credentials to environment variables, specify them in the configuration file.

    1. Download the [conn-man-secret-access.tf](https://github.com/yandex-cloud-examples/yc-connection-manager-secret-access/blob/main/conn-man-secret-access.tf) configuration file to the same working directory.

        This file describes:

        * Managed Service for PostgreSQL cluster.
        * Setting up service account permissions to access the Managed Service for PostgreSQL user's secret.
        * Getting connection ID and secret ID.     

    1. Specify the following in the configuration file:
        
        * `network_id`: [Network](../../vpc/concepts/network.md#network) ID for the cluster.
        * `subnet_id`: [Subnet](../../vpc/concepts/network.md#subnet) ID in the `ru-central1-a` [availability zone](../../overview/concepts/geo-scope.md) for the cluster.
        * `pg_cluster_version`: PostgreSQL version.
        * `pg_cluster_name`: Cluster name.
        * `pg_cluster_db`: Cluster database name.
        * `pg_cluster_username`: Cluster username.
        * `pg_cluster_password`: User password.
        * `lockbox_sa_id`: ID of the service account for which access to the secret will be configured.

    1. Validate your Terraform configuration files using this command:

        ```bash
        terraform validate
        ```

        Terraform will display any configuration errors detected in your files.

    1. Create the required infrastructure:

        1. Run this command to view the planned changes:
        
           ```bash
           terraform plan
           ```
        
           If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
        
        1. If everything looks correct, apply the changes:
           1. Run this command:
        
              ```bash
              terraform apply
              ```
        
           1. Confirm updating the resources.
           1. Wait for the operation to complete.

        All the required resources will be created in the specified folder. You can check resource availability and their settings in the [management console](https://console.yandex.cloud).
    
    1. After you apply the configuration, Terraform will output the connection and secret IDs.

        Here is an example of the command output:
        
        > ```bash
        > Outputs:
        >
        > connection_id = "a59v09bb8907********"
        > connection_info = "e6q2rjghh9bc********"
        > ```

        Save the `connection_info` secret ID for later to [get the user password](#get-password).

{% endlist %}

## Get the user password from the Yandex Lockbox secret {#get-password}

1. [Authenticate to the Yandex Cloud CLI as a service account using an authorized key](../../cli/operations/authentication/service-account.md#auth-as-sa).

1. Get the user password from the secret and save it to the `PASSWORD` variable: 

    {% list tabs group=instructions %}

    - CLI {#cli}

      ```bash
      PASSWORD=$(yc lockbox payload get <secret_ID> \
        --format json \
        | jq -r '.entries[] | select(.key=="postgresql_password") | .text_value')
      ```

    {% endlist %}

1. To view the saved password, run this command:

    ```bash
    echo "$PASSWORD"
    ```

## Delete the resources you created {#clear-out}

Some resources are not free of charge. Delete the resources you no longer need to avoid paying for them:

{% list tabs group=instructions %}

- Terraform {#tf}

    1. In the terminal window, go to the directory containing the infrastructure plan.
    
        {% note warning %}
    
        Make sure the directory has no Terraform manifests with the resources you want to keep. Terraform deletes all resources that were created using the manifests in the current directory.
    
        {% endnote %}
    
    1. Delete resources:
    
        1. Run this command:
    
            ```bash
            terraform destroy
            ```
    
        1. Confirm deleting the resources and wait for the operation to complete.
    
        All the resources described in the Terraform manifests will be deleted.

{% endlist %}