--- title: "Access" slug: "dev-catalog-operations-access" updated: 2026-10-30T18:18:56Z published: 2026-10-30T18:18:56Z canonical: "docs.vastdata.com/dev-catalog-operations-access" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt > Use this file to discover all available pages before exploring further. # Access *Applies to VAST Cluster 5.5.* What to ask your platform team for, so that you can query the VAST Catalog and the audit log, and how to check that it works. Enabling the tables and granting access are admin tasks; this page tells you what to request. ## What to ask for ![Five items, in order, then your client queries. 1, platform team: enable the VAST Catalog, which is off by default; set its snapshot schedule and how long copies are kept, and wait for the first indexing to finish. 2, platform team, for the audit log only: save audit logs to VAST DataBase, with the protocols and operation categories to audit, and optionally user names and full paths; records are kept for the retention period. 3, platform team: an endpoint, a virtual IP pool that serves VAST DataBase. 4, platform team: an S3 access key pair for a VAST user in your tenant. 5, platform team: an identity policy with s3:TabularQueryData on vast-big-catalog-bucket, for the whole Catalog or one path, and on vast-audit-log-bucket for the audit log. Then your client queries: tx.catalog() and tx.audit_log() in the Python SDK, or the same tables through Trino or Spark; with a path-scoped key, filter on search_path equal to the path with its trailing slash.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/cat-setup-flow.svg?sv=2026-02-06&spr=https&st=2026-11-08T08%3A55%3A07Z&se=2026-11-08T09%3A55%3A07Z&sr=c&sp=r&sig=ZfDvauVQNQ8guWnY%2Fu8oiOXY7vpINfsl%2F0gxCS7Ff8Y%3D) *What your platform team sets up, in order, before you query.* | You need | Who provides it | Notes | | --- | --- | --- | | The Catalog enabled | Platform team | Disabled by default. KB: [Configuring VAST Catalog](/docs-5-5/docs/configuring-vast-catalog). It can't be enabled on a cluster that uses EKM-managed encryption keys. | | The audit log saved to VAST DataBase | Platform team | "Save audit logs to VAST DB" in the global auditing settings, with the protocols and operation categories you need audited. KB: [Configuring Global Auditing Settings](/docs-5-5/docs/configuring-global-auditing-settings), and per view policy: [Configuring Auditing with View Policies](/docs-5-5/docs/configuring-auditing-with-view-policies). | | An endpoint | Platform team | A virtual IP (or DNS name) from a VIP pool that serves VAST DataBase. The same as for your own tables: [setup prerequisites](/develop/docs/dev-database-operations-setup-prerequisites). | | A user with an S3 access key pair | Platform team | KB: [Managing User S3 Permissions](/docs-5-5/docs/managing-s3-user-permissions#managing-user-s3-permissions). | | An identity policy on that user | Platform team | Allows querying the Catalog, the audit log, or both; see below. KB: [Client Access to the VAST Catalog](/docs-5-5/docs/client-access-to-the-vast-catalog). | Also ask, so you know what your results cover: the Catalog's snapshot schedule and how long copies are kept, which protocols and operations are audited, whether user names are logged, and how long audit records are kept. ## The identity policy Querying the Catalog needs the `s3:TabularQueryData` action on the Catalog's database, `vast-big-catalog-bucket`. A policy can grant it for the whole Catalog or for one path in it. **Admin task: send to your platform team.** For the whole Catalog (everything in your tenant): ``` { "Version": "2012-10-17", "Statement": [ { "Sid": "QueryCatalog", "Effect": "Allow", "Action": "s3:TabularQueryData", "Resource": [ "arn:aws:s3:::vast-big-catalog-bucket", "arn:aws:s3:::vast-big-catalog-bucket/*" ] } ] } ``` For one path, such as `/projects/`, and everything under it, change the resources to `arn:aws:s3:::vast-big-catalog-bucket/projects/*`. With a path-scoped policy, every query needs a `search_path` filter inside that path, written with its trailing slash: `/projects/` or a path below it works, but `/projects`, `/`, a query without `search_path` and a query that filters only on `parent_path` all fail with `Forbidden`. That action alone is enough: with it, the Python SDK opens the Catalog, reads it and lists its snapshots. Without it, `tx.catalog().columns()` still works, but `select()` fails with `Forbidden` (HTTP 403, `AccessDenied`). The audit log needs its own grant: the same action on `vast-audit-log-bucket`. A Catalog-only policy gets `Forbidden` from `tx.audit_log()`. Add this statement to the policy: ``` { "Sid": "QueryAuditLog", "Effect": "Allow", "Action": "s3:TabularQueryData", "Resource": [ "arn:aws:s3:::vast-audit-log-bucket", "arn:aws:s3:::vast-audit-log-bucket/*" ] } ``` ## Tenants On a cluster with several tenants, your queries return only your own tenant's elements: the user's tenant decides what the Catalog shows. Cluster administrators can query every tenant's data. If you need a report across tenants, that's for your platform team to run. ## Check that it works Open both tables and read one row from each. A table that isn't enabled, or that your key can't read, fails here with the error in [troubleshooting](/develop/docs/dev-catalog-troubleshooting-index): ``` import vastdb session = vastdb.connect() for label in ["catalog", "audit_log"]: try: with session.transaction() as tx: rows = getattr(tx, label)().select(limit_rows=1).read_all() print(f"{label}: OK, {len(rows.schema)} columns") except Exception as e: print(f"{label}: {type(e).__name__}") ``` ``` catalog: OK, 35 columns audit_log: OK, 51 columns ``` ## See also - [Setup prerequisites](/develop/docs/dev-database-operations-setup-prerequisites) and [security](/develop/docs/dev-database-operations-security) for VAST DataBase. - [CI/CD and automation](/develop/docs/dev-catalog-operations-ci-cd): the Catalog's settings in code.