Access

Applies to VAST Cluster 5.5.

What to ask your platform team for, so that you can query the VAST Catalog and the audit log, and how to check that it works. Enabling the tables and granting access are admin tasks; this page tells you what to request.

What to ask for

What your platform team sets up, in order, before you query.

You need	Who provides it	Notes
The Catalog enabled	Platform team	Disabled by default. KB: Configuring VAST Catalog. It can't be enabled on a cluster that uses EKM-managed encryption keys.
The audit log saved to VAST DataBase	Platform team	"Save audit logs to VAST DB" in the global auditing settings, with the protocols and operation categories you need audited. KB: Configuring Global Auditing Settings, and per view policy: Configuring Auditing with View Policies.
An endpoint	Platform team	A virtual IP (or DNS name) from a VIP pool that serves VAST DataBase. The same as for your own tables: setup prerequisites.
A user with an S3 access key pair	Platform team	KB: Managing User S3 Permissions.
An identity policy on that user	Platform team	Allows querying the Catalog, the audit log, or both; see below. KB: Client Access to the VAST Catalog.

Also ask, so you know what your results cover: the Catalog's snapshot schedule and how long copies are kept, which protocols and operations are audited, whether user names are logged, and how long audit records are kept.

The identity policy

Querying the Catalog needs the s3:TabularQueryData action on the Catalog's database, vast-big-catalog-bucket. A policy can grant it for the whole Catalog or for one path in it.

Admin task: send to your platform team. For the whole Catalog (everything in your tenant):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "QueryCatalog",
      "Effect": "Allow",
      "Action": "s3:TabularQueryData",
      "Resource": [
        "arn:aws:s3:::vast-big-catalog-bucket",
        "arn:aws:s3:::vast-big-catalog-bucket/*"
      ]
    }
  ]
}

For one path, such as /projects/, and everything under it, change the resources to arn:aws:s3:::vast-big-catalog-bucket/projects/*. With a path-scoped policy, every query needs a search_path filter inside that path, written with its trailing slash: /projects/ or a path below it works, but /projects, /, a query without search_path and a query that filters only on parent_path all fail with Forbidden.

That action alone is enough: with it, the Python SDK opens the Catalog, reads it and lists its snapshots. Without it, tx.catalog().columns() still works, but select() fails with Forbidden (HTTP 403, AccessDenied).

The audit log needs its own grant: the same action on vast-audit-log-bucket. A Catalog-only policy gets Forbidden from tx.audit_log(). Add this statement to the policy:

{
  "Sid": "QueryAuditLog",
  "Effect": "Allow",
  "Action": "s3:TabularQueryData",
  "Resource": [
    "arn:aws:s3:::vast-audit-log-bucket",
    "arn:aws:s3:::vast-audit-log-bucket/*"
  ]
}

Tenants

On a cluster with several tenants, your queries return only your own tenant's elements: the user's tenant decides what the Catalog shows. Cluster administrators can query every tenant's data. If you need a report across tenants, that's for your platform team to run.

Check that it works

Open both tables and read one row from each. A table that isn't enabled, or that your key can't read, fails here with the error in troubleshooting:

import vastdb

session = vastdb.connect()
for label in ["catalog", "audit_log"]:
    try:
        with session.transaction() as tx:
            rows = getattr(tx, label)().select(limit_rows=1).read_all()
        print(f"{label}: OK, {len(rows.schema)} columns")
    except Exception as e:
        print(f"{label}: {type(e).__name__}")

catalog: OK, 35 columns
audit_log: OK, 51 columns

Access

What to ask for

The identity policy

Tenants

Check that it works

See also