Access management
In this section, you'll learn:
About access management
All transactions in Yandex.Cloud are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.
To grant permission to a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, service account, or system group. For more information, see How access management in Yandex.Cloud works.
Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.
What resources you can assign roles to.
As with other services, you can assign roles for clouds, folder, and service accounts. The roles assigned for clouds and folders also apply to nested resources.
What roles exist in the service
The diagram shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all viewer role permissions. A description of each role is given under the diagram.
Active roles in the service:
- Service roles:
-
compute.images.user: Allows you to use images to create new resources, such as virtual machines. -
compute.disks.user: Lets you use disks to create new resources, such as virtual machines. -
iam.serviceAccounts.user: Verifies the right to use the service account.This role is required to execute operations in Instance Groups. If you have entered a service account in the request, IAM checks that you have rights to use this account.
-
resource-manager.clouds.owner: Grants you full access to the cloud and the resources in it. You can only assign this role for a cloud. -
resource-manager.clouds.member: The role needed to perform any operation in the cloud on behalf of a Yandex account. The role is assigned automatically when a user is added to the cloud. You can only assign this role for a cloud.
-
- Primitive roles: