--- title: "Setup prerequisites" slug: "dev-database-operations-setup-prerequisites" description: "Set up VAST DataBase with Python SDK, Trino, or Spark. Follow our checklist for permissions and actions to ensure smooth operation and access." updated: 2026-11-05T15:48:01Z published: 2026-11-05T15:48:01Z canonical: "docs.vastdata.com/dev-database-operations-setup-prerequisites" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt > Use this file to discover all available pages before exploring further. # Setup prerequisites *Applies to VAST Cluster 5.5. Examples use the VAST DataBase Python SDK 2.1.0.* Before you can use VAST DataBase from the Python SDK, Trino, Spark or another client, your platform team has to set up a few things on the cluster. This page lists them, says what to ask for, and shows how to check that everything works. ## Checklist ![Your client, such as the Python SDK, Trino or Spark, connects over HTTP or HTTPS to a database endpoint: the address of a virtual IP pool that serves VAST DataBase, not the management address. It signs each request with an access key. On the cluster, the user's identity policy decides what the key may do, and the database is a bucket on a Database-enabled view. Clients of the VAST Query Engine (ADBC) connect to a Query Engine virtual IP pool instead. Your platform team provides the endpoint, the keys, the policy and the database.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/setup-connections.svg?sv=2026-02-06&spr=https&st=2026-11-08T08%3A54%3A51Z&se=2026-11-08T09%3A54%3A51Z&sr=c&sp=r&sig=VdlofjXqcULduTeVRCNZaQpqJhcn1TuwHzwUQIGKNfw%3D) *What your client connects to, and what your platform team provides.* | You need | What it is | Who provides it | | --- | --- | --- | | A database | A bucket on a Database-enabled view. Your tables live in schemas inside it. | Platform team | | An endpoint | The address of a virtual IP pool that serves the database, for example `http://vastdb.example.com`. Not the management (VMS) address. | Platform team | | An access key pair | An S3 access key and secret key for a VAST user | Platform team | | Permissions | An identity policy on that user, with the actions for what you plan to do (see [below](/develop/docs/dev-database-operations-setup-prerequisites#permissions)) | Platform team | | Network access | Your client can reach the endpoint over HTTP or HTTPS | Your network team, or the platform team | | For the VAST Query Engine only | A virtual IP pool dedicated to the Query Engine, and `s3:QueryEngine*` permissions | Platform team | **Admin task: send to your platform team.** The setup steps are in the KB: [Configuring the VAST Cluster for Database Access](/docs-5-5/docs/configuring-the-vast-cluster-for-database-access) (database, owner user and keys) and [Managing Permissions for Accessing VAST Tabular Databases](/docs-5-5/docs/managing-permissions-for-accessing-vast-tabular-databases) (identity policies). For the Query Engine, see [VAST Query Engine](/docs-5-5/docs/vast-query-engine#accessing-vast-databases-using-the-query-engine). ![Six items, in order, then your client connects. 1, platform team: a database, a bucket on a Database-enabled view; your tables live in schemas inside it. 2, platform team: an endpoint, the address of a virtual IP pool that serves the database, not the management (VMS) address. 3, platform team: an S3 access key and secret key for a VAST user. 4, platform team: an identity policy on that user, with s3:ListBucket on the bucket and the Tabular actions you need on the bucket and everything in it. 5, network team or platform team: network access from your client to the endpoint over HTTP or HTTPS. 6, platform team, for the VAST Query Engine only: a virtual IP pool dedicated to the Query Engine, and s3:QueryEngine* permissions. Then your client, such as the Python SDK, Trino or Spark, connects to the endpoint with the access key; vastdb.connect() and tx.bucket() check the setup.](https://cdn.us.document360.io/89b91113-5dc6-49db-86ec-57b16dc8ce56/Images/Documentation/db-setup-flow.svg?sv=2026-02-06&spr=https&st=2026-11-08T08%3A54%3A51Z&se=2026-11-08T09%3A54%3A51Z&sr=c&sp=r&sig=VdlofjXqcULduTeVRCNZaQpqJhcn1TuwHzwUQIGKNfw%3D) *What your platform team sets up, in order, before your client connects.* ## What to send your platform team Copy this and fill it in: ``` I need access to VAST DataBase for . - Database: an existing database (bucket) , or please create one. - Endpoint: a virtual IP pool address or DNS name that serves VAST DataBase, reachable from . - Credentials: an S3 access key pair for a user . - Permissions: an identity policy for that user on the database, allowing s3:ListBucket on , and these Tabular actions on and /*: - (If using the VAST Query Engine) s3:QueryEngine* and the Query Engine VIP pool address. - (If using ADBC end-user impersonation) s3:EndUserImpersonation for the service account. ``` ## Permissions An identity policy grants actions on resources. For a database named `my-db`, the resources are the bucket itself (`my-db`, for bucket-level actions such as listing schemas) and everything in it (`my-db/*`). See [Managing Permissions for Accessing VAST Tabular Databases](/docs-5-5/docs/managing-permissions-for-accessing-vast-tabular-databases). ### Actions each SDK operation needs Every SDK workflow starts with `tx.bucket(name)`, which needs **`s3:ListBucket`** (or `s3:HeadBucket`) on the bucket. This isn't a Tabular action, so a policy that grants only `s3:Tabular*` fails at that first step with a `Forbidden` error and no code. Opening a schema or table needs a few list and get actions too, because the SDK loads each table's columns and statistics when it opens the table. The table below shows what each operation needs on top of those. | SDK operation | Actions needed | | --- | --- | | `tx.bucket(name)` | `s3:ListBucket` | | `bucket.schemas()`, `bucket.schema(name)` | `s3:ListBucket`, `s3:TabularListSchemas` | | `schema.tables()`, `schema.table(name)`, `table.get_stats()` | The above, plus `s3:TabularListTables`, `s3:TabularListColumns`, `s3:TabularGetTableStats` | | **Everything below** | **All of the above**, plus: | | `table.select()` | `s3:TabularQueryData` | | `table.insert()` | `s3:TabularInsertRows` | | `table.update()` | `s3:TabularUpdateRows`, and `s3:TabularQueryData` to select the rows first | | `table.delete()` | `s3:TabularDeleteRows`, and `s3:TabularQueryData` to select the rows first | | `table.import_files()` | `s3:TabularImportData` | | `schema.create_table()` | `s3:TabularCreateTable` | | `table.rename()` | `s3:TabularAlterTable` | | `table.drop()` | `s3:TabularDropTable` | | `table.add_column()` | `s3:TabularAddColumns` | | `table.drop_column()` | `s3:TabularDropColumns` | | `table.create_projection()` | `s3:TabularCreateProjection`, `s3:TabularListProjections` | | `table.projections()` | `s3:TabularListProjections` | | `bucket.create_schema()` | `s3:TabularCreateSchema` | | `schema.rename()` | `s3:TabularAlterSchema` | | `schema.drop()` | `s3:TabularDropSchema` (and `s3:TabularDropTable` to drop its tables first) | | `table.delete_partitions()` | `s3:TabularDeletePartitions` | Include the transaction actions too: `s3:TabularBeginTransaction`, `s3:TabularCommitTransaction`, `s3:TabularRollbackTransaction` and `s3:TabularGetTransaction`, for example as `s3:Tabular*Transaction`. For other operations, see the [list of Tabular actions](/docs-5-5/docs/managing-permissions-for-accessing-vast-tabular-databases#common-actions-for-database-usage). **Other engines and clients:** - **VAST Query Engine:** also needs `s3:QueryEngine*` ([VAST Query Engine](/docs-5-5/docs/vast-query-engine#accessing-vast-databases-using-the-query-engine)). The policy must be attached to the user in the database's tenant. For a user of the cluster's default local provider, attaching it without naming the tenant attaches it in the default tenant, and every Query Engine request then fails with `request was denied according to policies res=2`, even `SELECT 1`, while the SDK's own calls still work for the bucket owner. To attach it in the tenant: `user modify --tenant-id` in the VAST CLI, or `PATCH /api/users/<user id>/tenant_data/` with `tenant_id` ([Vector Search setup](/develop/docs/dev-vector-search-operations-setup#permissions)). - **ADBC end-user impersonation** (`Session(end_user=...)`): the ADBC driver's service account needs `s3:EndUserImpersonation`; see "ADBC User Impersonation" on the same page. - **Row and column security with Trino:** the Trino user needs `s3:EndUserImpersonation` and `s3:TabularGetRowColumnSecurity`. `s3:Tabular*` covers the second but not the first. See [security](/develop/docs/dev-database-operations-security). ### Example policies A practitioner policy that can read, write and change tables in one database, `my-db`: ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": ["s3:ListBucket", "s3:Tabular*"], "Resource": ["my-db", "my-db/*"] } ] } ``` A read-only policy (list and query) for the same database: ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:ListBucket", "s3:Tabular*Transaction", "s3:TabularList*", "s3:TabularGetTableStats", "s3:TabularQueryData" ], "Resource": ["my-db", "my-db/*"] } ] } ``` Check the action names carefully: the cluster accepts a policy even if it contains an action name that doesn't exist, and that action then grants nothing. A key with the read-only policy can list schemas and tables and run `select()`. `create_schema()` and `insert()` fail with `Forbidden` (`AccessDenied`). The SDK doesn't list buckets, so it doesn't need the `ListBuckets` permission in the view policy. Tools that list your databases may need it. ## Check that it works Set the environment variables from the [quickstart](/develop/docs/dev-database-quickstart#2-connect), then run: ``` import os import vastdb session = vastdb.connect() with session.transaction() as tx: bucket = tx.bucket(os.environ["VASTDB_BUCKET"]) print("Connected to database:", bucket.name) print("Schemas:", [s.name for s in bucket.schemas()]) ``` ``` Connected to database: docs-capture-db Schemas: [] ``` Your list of schemas depends on what's in your database; a new database has none. Each step checks one item on the checklist: | Fails at | Error | What to check | | --- | --- | --- | | `vastdb.connect()` | `ConnectionError` | The endpoint address and network access. See [errors](/develop/docs/dev-database-troubleshooting-errors#connecting). | | `vastdb.connect()` | `UnsupportedServer` | The endpoint is something other than a VAST DataBase VIP, for example the management address. | | `vastdb.connect()` | `Forbidden` with code `SignatureDoesNotMatch` | The secret key is wrong. | | `vastdb.connect()` | `Forbidden` with code `InvalidAccessKeyId` | The cluster doesn't know the access key. | | `tx.bucket(...)` | `MissingBucket` | The database name. | | `tx.bucket(...)` | `Forbidden` with no code, on a `HEAD` request | The identity policy: `s3:ListBucket` is missing, or there's no policy at all. | | `bucket.schemas()` | `Forbidden` with code `AccessDenied` | The identity policy: `s3:TabularListSchemas` is missing. | If all three lines run, your endpoint, keys and basic permissions are right. To check a particular operation, such as creating a table, run it; a missing action shows up as `Forbidden` with code `AccessDenied` (see [errors](/develop/docs/dev-database-troubleshooting-errors#vastdberrorsforbidden-http-403)). ## Next steps - [Quickstart](/develop/docs/dev-database-quickstart): create a table, insert rows and query them. - [Security](/develop/docs/dev-database-operations-security): how identity policies and row and column security affect your queries. - [Version compatibility](/develop/docs/dev-database-reference-versions): which SDK and connector versions go with your cluster.