Access management
Yandex.Cloud users can only perform operations on resources that are allowed by the roles assigned to them. If a user doesn't have any roles assigned, almost all operations are forbidden. Regardless of the roles assigned, the user can view reference lists of availability zones and disk types.
To allow access to Yandex Compute Cloud resources (VMs, disks, images, and snapshots), assign the user the required roles from the list below. At this time, a role can only be assigned to a parent resource (folder or cloud), and the roles are inherited by nested resources.
Note
For more information about role inheritance, see Access rights inheritance in the Yandex Resource Manager documentation.
Assigning roles
To assign a role to a user:
-
Open the Access management page for the selected cloud. If necessary, switch to another cloud.
-
Select the user to assign the role to, click
, and choose Configure roles. -
To add a cloud role, click
in the Roles for cloud section. To add a folder role, select the folder and click Assign role in the Roles in folders section.
-
Choose a role from the list.
Roles
The list below shows all roles that are considered when verifying access rights in the Compute Cloud service.
Service roles
Service roles are roles that allow access to the resources of a particular service. When checking Compute Cloud resource access rights, Compute Cloud and Resource Manager service roles are considered.
compute.disks.user
The compute.disks.user role includes the following permissions:
- Get a list of disks.
- Get information about a disk.
- Use a disk to create new resources (images, snapshots, new disks, and virtual machines).
Note
This role is not sufficient to mark the disk as automatically deletable when creating a virtual machine. To do this, use the editor role.
Currently, this role can only be assigned to a folder or cloud.
compute.images.user
The compute.images.user role includes the following permissions:
- Get a list of images.
- Get information about an image.
- Get information about the last image in the specified family.
- Use an image for creating new resources (virtual machines, disks, or other images).
Currently, this role can only be assigned to a folder or cloud.
resource-manager.clouds.member
When a new user is added to the cloud, they are automatically assigned the role of a cloud member: resource-manager.clouds.member.
This role must be assigned to everyone who needs to access cloud resources, except the owners of the cloud, service accounts, and system group allAuthenticatedUsers.
This role alone does not give you the right to perform any operations and is only used in combination with other roles, such as admin, editor, or viewer.
Important
To enable a user to work in the cloud through the management console, assign them the resource-manager.clouds.member and viewer roles for the cloud. If you assign only the cloud member role for the cloud and other roles for the nested resources, the user will only be able to perform resource operations using the API or CLI.
resource-manager.clouds.owner
The role of resource-manager.clouds.owner is assigned for the cloud and makes the user the owner of the cloud. The owner can perform any operations with the cloud and its resources.
Only the cloud owner can assign to or remove from the users the role resource-manager.clouds.owner.
A cloud must have at least one owner. The sole owner of a cloud may not give up this role.
Primitive roles
You can assign primitive roles to any resource in any service.
viewer
A user with the viewer can view information about resources, for example, view a list of disks or obtain information about a VM.
editor
A user with the editor can manage any resources, such as create, stop, or start a VM, and attach or detach a disk.
In addition, the editor role includes all permissions of the viewer role.
admin
A user with the admin can manage access rights to resources, for example, allow other users to create VMs or view information about them.
In addition, the admin role includes all permissions of the role of editor.