Access management
In this section, you'll learn:
- What resources you can assign the role to.
- What roles exist in the service.
- What roles are required for particular actions.
About access management
All transactions in Yandex.Cloud are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.
To grant permission to a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, service account, or system group. For more information, see How access management in Yandex.Cloud works.
Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.
What resources you can assign roles to
Now you can assign roles for a cloud and folder. These roles also apply to nested resources.
What roles exist in the service
The diagram shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all viewer role permissions. A description of each role is given under the diagram.
Active roles in the service:
-
viewer: Only lets you view information about the resources. -
editor: Lets you manage resources (create, edit, and delete). -
admin: Lets you manage resources and access them.
What roles do I need
The table below lists the roles needed to perform a given action. You can always assign a role granting more permissions than the role specified. For example, you can assign editor instead of viewer.
| Action | Methods | Required roles |
|---|---|---|
| KMS | ||
| Get information about keys and versions | get, list, listVersions |
viewer for the folder with keys |
| Create and update a key | create, update |
editor for the folder with the key |
| Encryption and decryption operations | encrypt, decrypt, reencrypt, generatedatakey |
editor for the folder with the key |
| Rotate a key and change the primary version | rotate, setPrimaryVersion |
admin for the folder with the key |
| Destroy a key and version | delete, scheduleVersionDestruction, cancelVersionDestruction |
admin for the folder with the keys |
| IAM | ||
| Grant roles, revoke roles, and view roles granted for the resource or cloud | setAccessBindings, updateAccessBindings, listAccessBindings |
admin for the folder or cloud |