In this section, you'll learn:
- What resources you can assign the role to.
- What roles exist in the service.
- What roles are required for particular actions.
About access management
All transactions in Yandex.Cloud are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.
To grant permission to a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, service account, or system group. For more information, see How access management in Yandex.Cloud works.
What resources you can assign roles to
What roles exist in the service
The diagram shows which roles are available in the service and how they inherit each other's permissions. For example, the
editor role includes all
viewer role permissions. A description of each role is given under the diagram.
Active roles in the service:
- Service roles:
resource-manager.clouds.owner: Grants you full access to the cloud and the resources in it. You can only assign this role for a cloud.
resource-manager.clouds.member: The role needed to perform any operation in the cloud on behalf of a Yandex account. The role is assigned automatically when a user is added to the cloud. You can only assign this role for a cloud.
- Primitive roles:
What roles do I need
The table below lists the roles needed to perform a given action. You can always assign a role granting more permissions than the role specified. For example, you can assign
editor instead of
|View information about any resource||
|List subnets in the network||
|Create networks in a folder||
|Update and delete networks||
|Create subnets in a folder||
|Update and delete subnets||
|Manage resource access|
|Assign a role, revoke a role, and view roles granted for the resource||