[Yandex Cloud documentation](../../index.md) > [Yandex Virtual Private Cloud](../index.md) > [Tutorials](index.md) > Configuring network resources and interaction between them > Configuring a network for Yandex Data Processing

# Configuring a network for Yandex Data Processing


In this tutorial, you will learn how to create a Yandex Data Processing cluster and set up subnets and a NAT gateway.


## Required paid resources {#paid-resources}

The support cost includes:

* Yandex Data Processing cluster fee: using VM computing resources and Compute Cloud network disks, and Cloud Logging for log management (see [Yandex Data Processing pricing](../../data-proc/pricing.md)).
* Fee for a NAT gateway (see [Virtual Private Cloud pricing](../pricing.md)).
* Fee for an Object Storage bucket: data storage and operations (see [Object Storage pricing](../../storage/pricing.md)).


## Create resources {#deploy-infrastructure}

{% list tabs group=instructions %}

- Manually {#manual}

    1. [Create a network](../operations/network-create.md) named `data-proc-network` with the **Create subnets** option disabled.
    1. In `data-proc-network`, [create a subnet](../operations/subnet-create.md) with the following settings:

        * **Name**: `data-proc-subnet-a`
        * **Availability zone**: `ru-central1-a`
        * **CIDR**: `192.168.1.0/24`

    1. [Create a NAT gateway](../operations/create-nat-gateway.md) and a route table named `data-proc-route-table` in `data-proc-network`. Associate the table with `data-proc-subnet-a`.

    1. In `data-proc-network`, [create a security group](../operations/security-group-create.md) named `data-proc-security-group` with the following rules:

        * One rule for incoming and another one for outgoing service traffic:

            * **Port range**: `0-65535`
            * **Protocol**: `Any`
            * **Source**/**Destination name**: `Security group`
            * **Security group**: `Current`

        * Rule for outgoing HTTPS traffic:

            * **Port range**: `443`
            * **Protocol**: `TCP`
            * **Destination name**: `CIDR`
            * **CIDR blocks**: `0.0.0.0/0`

        * Rule that allows access to NTP servers for time syncing:

            * **Port range**: `123`
            * **Protocol**: `UDP`
            * **Destination name**: `CIDR`
            * **CIDR blocks**: `0.0.0.0/0`

        {% note info %}
        
        You can configure [additional security group rules](../../data-proc/operations/security-groups.md) to connect to cluster hosts.
        
        {% endnote %}

    1. [Create a service account](../../iam/operations/sa/create.md) named `data-proc-sa` with the following roles:

        * [dataproc.agent](../../data-proc/security/index.md#dataproc-agent)
        * [dataproc.provisioner](../../data-proc/security/index.md#dataproc-provisioner)
        * [storage.uploader](../../storage/security/index.md#storage-uploader)
        * [storage.viewer](../../storage/security/index.md#storage-viewer)

    1. [Create a Yandex Object Storage bucket](../../storage/operations/buckets/create.md) with restricted access.

    1. [Create a Yandex Data Processing cluster](../../data-proc/operations/cluster-create.md) in any suitable configuration with the following settings:

        * **Service account**: `data-proc-sa`.
        * **Bucket ID format**: `List`.
        * **Bucket name**: Select the bucket you created earlier.
        * **Network**: `data-proc-network`.
        * **Security groups**: `data-proc-security-group`.

- Terraform {#tf}

    1. If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
       
       
       To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.
    1. [Get the authentication credentials](../../tutorials/infrastructure-management/terraform-quickstart.md#get-credentials) and specify the Yandex Cloud provider installation source (see [Configure your provider](../../tutorials/infrastructure-management/terraform-quickstart.md#configure-provider), Step 1).
    1. [Download the cluster configuration file](https://github.com/yandex-cloud-examples/yc-data-proc-configure-network/blob/main/data-proc-nat-gateway.tf) to the same working directory.

        This file describes:

        * Network.
        * Subnet.
        * NAT gateway and route table.
        * Security group.
        * Service account to work with cluster resources.
        * Service account for bucket management.
        * Static access key required to grant the service account permissions for the bucket.
        * Bucket to store job dependencies and results.
        * Yandex Data Processing cluster.

        {% note info %}
        
        You can configure [additional security group rules](../../data-proc/operations/security-groups.md) to connect to cluster hosts.
        
        {% endnote %}

    1. In the configuration file, specify all the relevant parameters.

    1. Run the `terraform init` command in the working directory with the configuration files. This command initializes the provider specified in the configuration files and enables you to use its resources and data sources.

    1. Make sure the Terraform configuration files are correct using this command:

        ```bash
        terraform validate
        ```

        Terraform will show any errors found in your configuration files.

    1. Create the required infrastructure:

        1. Run this command to view the intended changes:

            ```bash
            terraform plan
            ```

            If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

        1. If everything looks correct, apply the changes:

            1. Run this command:

                ```bash
                terraform apply
                ```

            1. Confirm updating the resources.

            1. Wait for the operation to complete.

    All the resources you need will be created in the specified folder. You can check the new resources and their settings using the [management console](https://console.yandex.cloud/cloud).

{% endlist %}

## Delete the resources you created {#clear-out}

Some resources are not free of charge. To avoid paying for them, delete the resources you no longer need:

{% list tabs group=instructions %}

- Manually {#manual}

    1. [Delete the Yandex Data Processing cluster](../../data-proc/operations/cluster-delete.md).
    1. If you reserved public static IP addresses, release and [delete them](../operations/address-delete.md).
    1. [Delete the subnet](../operations/subnet-delete.md).
    1. [Delete the route table](../operations/delete-route-table.md).
    1. [Delete the NAT gateway](../operations/delete-nat-gateway.md).
    1. [Delete the network](../operations/network-delete.md).

- Terraform {#tf}

    1. In the terminal window, go to the directory containing the infrastructure plan.
    
        {% note warning %}
    
        Make sure the directory has no Terraform manifests with the resources you want to keep. Terraform deletes all resources that were created using the manifests in the current directory.
    
        {% endnote %}
    
    1. Delete resources:
    
        1. Run this command:
    
            ```bash
            terraform destroy
            ```
    
        1. Confirm deleting the resources and wait for the operation to complete.
    
        All the resources described in the Terraform manifests will be deleted.

{% endlist %}