Yandex.Cloud
  • Services
  • Why Yandex.Cloud
  • Pricing
  • Documentation
  • Contact us
Get started
Yandex Managed Service for MongoDB
  • Getting started
  • Step-by-step instructions
    • All instructions
    • Information about existing clusters
    • Creating clusters
    • Database migration to Yandex.Cloud
    • Connecting to databases
    • Stop and start the cluster
    • Changing cluster and database settings
    • MongoDB version upgrade
    • Database management
    • Managing hosts in a cluster
    • Managing database users
    • Managing backups
    • How to manage shards
    • Deleting clusters
  • Solutions
    • Sharding collections
  • Concepts
    • Relationship between service resources
    • Host classes
    • Network in Yandex Managed Service for MongoDB
    • Quotas and limits
    • Storage types
    • Backups
    • Replication
    • Sharding
    • Users and roles
    • Supported clients
  • Access management
  • Pricing policy
    • Current pricing policy
    • Archive
      • Before January 1, 2019
      • From January 1 to March 1, 2019
      • From March 1, 2019 to February 1, 2020
  • API reference
    • Authentication in the API
    • gRPC
      • Обзор
      • BackupService
      • ClusterService
      • DatabaseService
      • ResourcePresetService
      • UserService
      • OperationService
    • REST
      • Overview
      • Backup
        • Overview
        • get
        • list
      • Cluster
        • Overview
        • addHosts
        • addShard
        • backup
        • create
        • delete
        • deleteHosts
        • deleteShard
        • enableSharding
        • get
        • getShard
        • list
        • listBackups
        • listHosts
        • listLogs
        • listOperations
        • listShards
        • move
        • rescheduleMaintenance
        • resetupHosts
        • restartHosts
        • restore
        • start
        • stop
        • streamLogs
        • update
      • Database
        • Overview
        • create
        • delete
        • get
        • list
      • ResourcePreset
        • Overview
        • get
        • list
      • User
        • Overview
        • create
        • delete
        • get
        • grantPermission
        • list
        • revokePermission
        • update
      • Operation
        • Overview
        • get
  • Questions and answers
    • General questions
    • Questions about MongoDB
    • All questions on the same page
  1. Access management

Access management

  • About access management
  • What resources you can assign roles to.
  • What roles exist in the service
  • What roles do I need

In this section, you'll learn:

  • What resources you can assign roles to.
  • What roles exist in the service.
  • What roles are required for particular actions.

About access management

All transactions in Yandex.Cloud are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.

To grant permission to a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, service account, or system group. For more information, see How access management works in Yandex.Cloud.

Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.

What resources you can assign roles to.

As with other services, you can assign roles for clouds, folder, and service accounts. The roles assigned for clouds and folders also apply to nested resources.

To allow access to Managed Service for MongoDB service resources (DB clusters and hosts, cluster backups, databases, and their users), assign the user the appropriate roles for the folder or cloud hosting the resources.

What roles exist in the service

The diagram shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all viewer role permissions. A description of each role is given under the diagram.

Active roles in the service:

  • Service roles:
    • resource-manager.clouds.owner: Grants you full access to the cloud and the resources in it. You can only assign this role for a cloud.

    • resource-manager.clouds.member: The role needed to perform any operation in the cloud on behalf of a Yandex account. The role is assigned automatically when a user is added to the cloud. You can only assign this role for a cloud.

  • Primitive roles:
    • viewer: Only lets you view information about the resources.

    • editor: Lets you manage resources (create, edit, and delete).

    • admin: Lets you manage resources and access them.

What roles do I need

The table below lists the roles needed to perform a given action. You can always assign a role granting more permissions than the role specified. For example, you can assign editor instead of viewer.

Action Methods Required roles
View data
View information about the cluster and related resources get, list viewer for the folder hosting the cluster
Manage resources
Create clusters and backups in the folder create editor for the folder
Change and delete clusters and related resources update, delete editor for the folder hosting the cluster
Manage resource access
Add, edit, remove cluster users create, update, delete editor for the folder hosting the cluster
Assign, revoke, and view roles granted for the resource or cloud setAccessBindings, updateAccessBindings, listAccessBindings admin for this folder or cloud

What's next

  • How to assign a role.
  • How to revoke a role.
  • Read more about access management in Yandex.Cloud.
  • More about role inheritance.
In this article:
  • About access management
  • What resources you can assign roles to.
  • What roles exist in the service
  • What roles do I need
Language
Careers
Privacy policy
Terms of use
© 2021 Yandex.Cloud LLC