> ## Documentation Index
> Fetch the complete documentation index at: https://developer.upsun.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Restrict access to a service

> Learn how to restrict access to a service using a worker and additional endpoints to the service.

Upsun Cloud allows you to restrict access to a service.

In this tutorial, learn how to grant your Data team `read-only` access to your production database.

## Before you start

You need:

* A project with a database service
* A `viewer` user on your project

## 1. Add a read-only endpoint to your database service

Edit your `.upsun/config.yaml` file and add the following [endpoints](https://developer.upsun.com/docs/add-services/mysql#define-permissions):

* `website` with `admin` access to the `main` database
* `reporting` with read-only `ro` access to the `main` database


    services:
      maindb:
        type: mariadb:\{\{version:mariadb:latest}}
        configuration:
          schemas:
            \- main
          endpoints:
            website:
              default\_schema: main
              privileges:
                main: admin
            reporting:
              privileges:
                main: ro

## 2. Grant your app access to the new endpoints

Edit your app configuration and add new relationships to your new endpoints:


    applications:
&#x20;     \<APP\_NAME>:
&#x20;       \# ...
&#x20;       relationships:
&#x20;         database:
&#x20;           service: maindb
&#x20;           endpoint: website
&#x20;         reports:
&#x20;           service: maindb
&#x20;           endpoint: reporting
&#x20;&#x20;

## 3. Create a worker with access to the read-only endpoint

Edit your app configuration to add a new worker which:

* Does nothing (`sleep infinity`)
* Can access the read-only `reporting` endpoint
* Allows SSH access to `viewer`


&#x20;   applications:
&#x20;     \<APP\_NAME>:
&#x20;       workers:
&#x20;         data\_access:
&#x20;           mounts: \{}
&#x20;           commands:
&#x20;             start: |
&#x20;               sleep infinity
&#x20;           relationships:
&#x20;             reports:
&#x20;               service: maindb
&#x20;               endpoint: reporting
&#x20;           access:
&#x20;             ssh: viewer
&#x20;&#x20;

You're done!
From now on, your `viewer` users can SSH in to the worker application,
and connect to your database with read-only permissions.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.