---
title: "Client Access to the VAST Catalog"
slug: "client-access-to-the-vast-catalog"
tags: ["5.5"]
updated: 2026-10-27T23:00:54Z
published: 2026-10-27T23:00:54Z
canonical: "docs.vastdata.com/client-access-to-the-vast-catalog"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vastdata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Client Access to the VAST Catalog

You can access the VAST Catalog using a number of client applications:

- The [VAST Catalog CLI](/docs-5-5/docs/vast-database-cli-quick-start-guide)
- Third-party query engines connected to the VAST Database, such as [Trino](/docs-5-5/docs/installing-and-configuring-the-vast-connector-for-trino) and [Spark](/docs-5-5/docs/installing-the-vast-connector-for-spark-tg)
- The [VAST DB SDK](https://github.com/vast-data/vastdb_sdk)

The following are required for the client to access the Catalog:

- A host IP address on the cluster
- An Identity Policy providing access to the Catalog
- A user associated with the Identity Policy
- S3 access keys for the user

## Providing a Host IP to Access the VAST Catalog

Use one of the virtual IPs from a VAST Cluster [virtual IP pool](/docs-5-5/docs/managing-virtual-ip-pools) to access the VAST Catalog.

## Granting User Access and Permission to Query the VAST Catalog

In order to be able to query VAST Catalog from the [VASTDB Python SDK](https://github.com/vast-data/vastdb_sdk) or another client, such as Trino, users need an S3 access key pair, and permission to perform the `TabularQueryData` action on the relevant data set. You can grant permission to query all data for the tenant on the cluster, or restrict permission to a given path. Permission is granted through an identity policy.

Cluster administrators can query catalog data for all tenants.

For example, to grant query permission and an S3 access key pair to a user with UID 513, for a specific part of the Catalog (`/a/b`), you could do the following:

1. Create an [identity policy](/docs-5-5/docs/managing-identity-policies) to provide query access to the VAST Catalog. The policy indicates which resources the user can access, in this case sections of the Catalog.

This example is an identity policy that grants access to the entire Catalog.

```plaintext
vcli: admin> identitypolicy create --name data_query --tenant-id 2 --policy '{
                 "Version": "2012-10-17",
                 "Id": "S3PolicyId1",
                 "Statement": [
                 {
                     "Sid": "AllowTabularQueryData",
                     "Effect": "Allow",
                     "Action": "s3:TabularQueryData",
                     "Resource":["arn:aws:s3:::vast-big-catalog-bucket/*","arn:aws:s3:::vast-big-catalog-bucket"]
                     "Resource":"arn:aws:s3:::vast-big-catalog-bucket/a/b/*"
                  }]
               }'
```

This example is a policy that provides access to a specific subsection of the Catalog, in this case the subdirectory `/a/b/`, and all objects within it.

```plaintext
vcli: admin> identitypolicy create --name data_query --tenant-id 2 --policy '{
                 "Version": "2012-10-17",
                 "Id": "S3PolicyId1",
                 "Statement": [
                 {
                     "Sid": "AllowTabularQueryData",
                     "Effect": "Allow",
                     "Action": "s3:TabularQueryData",
                     "Resource":"arn:aws:s3:::vast-big-catalog-bucket/a/b/*"
                  }]
               }'
```
2. Retrieve the ID of the policy:

```plaintext
vcli: admin> identitypolicy list
+----+-------------+-----------+--------+----------------------------------------------------------------------------------------------------------------+
| ID | Name        | Users     | Groups | Policy                                                                                                         |
+----+-------------+-----------+--------+----------------------------------------------------------------------------------------------------------------+
| 11 | data_query  | ['auser'] | []     | {"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": "s3:TabularQueryData", "Resource":"/a/b/*"}]} |
+----+-------------+-----------+--------+----------------------------------------------------------------------------------------------------------------+
```
3. Attach the policy to the user:

```plaintext
vcli: admin> user query --uid 513 --identity-policies-ids 11
```
4. Generate an S3 access key pair for the user, valid for the default tenant:

```plaintext
vcli: admin> user generate-key --uid 513
{'access_key': '*************',
 'secret_key': '*************************'}
```

For more information, see the following sections:

- Identity Policies: [Managing Identity Policies](/docs-5-5/docs/managing-identity-policies)
- Granting S3 Access Keys and Attaching Identity Policies to Users: [Managing User S3 Permissions](/docs-5-5/docs/managing-s3-user-permissions#managing-user-s3-permissions)