Yandex.Cloud
  • Services
  • Why Yandex.Cloud
  • Solutions
  • Pricing
  • Documentation
  • Contact us
Get started
Command line interface
  • Getting started with the CLI
  • Step-by-step instructions
    • All instructions
    • CLI installation
    • Authentication
      • Authenticating as a user
      • Authenticating as a service account
      • Authenticating as a federated user
    • Profile management
      • Creating a profile
      • Managing profile parameters
      • Getting profile information
      • Activating a profile
      • Deleting a profile
  • Concepts
    • Running commands
    • CLI configuration
    • Synchronous and asynchronous command execution modes
  • CLI releases
  • Troubleshooting
  • CLI reference
    • Overview
    • CLI management
      • init
      • version
      • help
      • config
        • Overview
        • profile
          • Overview
          • get
          • activate
          • delete
          • create
          • list
        • unset
        • set
        • get
        • list
      • components
        • Overview
        • restore
        • update
    • Operations management
      • Overview
      • wait
      • get
    • Services management
      • ydb
        • Overview
        • database
          • Overview
          • delete
          • update
          • restore
          • backup
          • create
          • list
          • get
        • storage-type
          • Overview
          • list
          • get
        • resource-preset
          • Overview
          • list
          • get
        • backup
          • Overview
          • delete
          • list
          • get
      • certificate-manager
        • Overview
        • certificate
          • Overview
          • remove-access-binding
          • add-access-binding
          • set-access-bindings
          • list-access-bindings
          • list-operations
          • delete
          • update
          • request
          • create
          • list
          • content
          • get
      • kms
        • Overview
        • symmetric-crypto
          • Overview
          • re-encrypt
          • generate-data-key
          • decrypt
          • encrypt
        • symmetric-key
          • Overview
          • cancel-version-destruction
          • schedule-version-destruction
          • set-primary-version
          • delete
          • create
          • update
          • list-versions
          • list
          • get
          • rotate
          • remove-access-binding
          • add-access-binding
          • set-access-bindings
          • list-access-bindings
          • list-operations
      • managed-clickhouse
        • Overview
        • user
          • Overview
          • remove-quota
          • update-quota
          • add-quota
          • revoke-permission
          • grant-permission
          • delete
          • create
          • update
          • list
          • get
        • backup
          • Overview
          • list
          • get
        • resource-preset
          • Overview
          • list
          • get
        • ml-model
          • Overview
          • delete
          • update
          • create
          • list
          • get
        • format-schema
          • Overview
          • delete
          • update
          • create
          • list
          • get
        • version
          • Overview
          • list
        • cluster
          • Overview
          • stop
          • start
          • move
          • remove-graphite-rollup
          • remove-external-dictionary
          • add-graphite-rollup
          • add-external-dictionary
          • set-compression
          • clear-compression
          • list-operations
          • list-logs
          • list-backups
          • backup
          • add-zookeeper
          • delete
          • remove-labels
          • add-labels
          • update-config
          • update
          • reschedule-maintenance
          • restore
          • create
          • list
          • get
        • hosts
          • Overview
          • delete
          • add
          • list
        • shards
          • Overview
          • delete
          • update-config
          • update
          • add
          • list
          • get
        • shard-groups
          • Overview
          • delete
          • update
          • create
          • list
          • get
        • database
          • Overview
          • delete
          • create
          • list
          • get
      • managed-mongodb
        • Overview
        • resource-preset
          • Overview
          • list
          • get
        • shards
          • Overview
          • delete
          • add
          • list
          • get
        • backup
          • Overview
          • get
          • list
        • cluster
          • Overview
          • enable-sharding
          • stop
          • start
          • move
          • list-operations
          • list-logs
          • list-backups
          • backup
          • delete
          • remove-labels
          • add-labels
          • update-config
          • update
          • reschedule-maintenance
          • create
          • restore
          • list
          • get
        • hosts
          • Overview
          • resetup
          • add
          • delete
          • list
        • database
          • Overview
          • delete
          • create
          • list
          • get
        • user
          • Overview
          • get
          • revoke-permission
          • grant-permission
          • delete
          • update
          • create
          • list
      • managed-mysql
        • Overview
        • hosts
          • Overview
          • delete
          • add
          • list
        • database
          • Overview
          • delete
          • create
          • get
          • list
        • user
          • Overview
          • revoke-permission
          • delete
          • grant-permission
          • update
          • create
          • list
          • get
        • resource-preset
          • Overview
          • list
          • get
        • cluster
          • Overview
          • stop
          • move
          • list-operations
          • list-logs
          • list-backups
          • backup
          • delete
          • remove-labels
          • add-labels
          • update-config
          • update
          • reschedule-maintenance
          • start-failover
          • restore
          • create
          • list
          • get
          • start
        • backup
          • Overview
          • list
          • get
      • resource-manager
        • Overview
        • folder
          • Overview
          • list-operations
          • remove-access-binding
          • add-access-binding
          • set-access-bindings
          • list-access-bindings
          • remove-labels
          • add-labels
          • update
          • create
          • list
          • get
        • cloud
          • Overview
          • set-access-bindings
          • list-access-bindings
          • update
          • list
          • get
          • add-access-binding
          • list-operations
          • remove-access-binding
      • dns
        • Overview
        • zone
          • Overview
          • remove-access-binding
          • add-access-binding
          • set-access-bindings
          • list-access-bindings
          • list-operations
          • remove-labels
          • add-labels
          • replace-records
          • delete-records
          • list-records
          • add-records
          • delete
          • update
          • list
          • create
          • get
      • vpc
        • Overview
        • security-group
          • Overview
          • update-rule-meta
          • update-rules
          • move
          • list-operations
          • delete
          • remove-labels
          • add-labels
          • update
          • create
          • list
          • get
        • route-table
          • Overview
          • move
          • list-operations
          • delete
          • remove-labels
          • add-labels
          • update
          • create
          • list
          • get
        • subnet
          • Overview
          • move
          • list-used-addresses
          • list-operations
          • delete
          • remove-labels
          • add-labels
          • update
          • create
          • list
          • get
        • address
          • Overview
          • list-operations
          • delete
          • update
          • create
          • list
          • get
        • network
          • Overview
          • update
          • create
          • list
          • get
          • move
          • list-operations
          • list-subnets
          • delete
          • remove-labels
          • add-labels
      • managed-postgresql
        • Overview
        • backup
          • Overview
          • list
          • get
        • resource-preset
          • Overview
          • list
          • get
        • cluster
          • Overview
          • stop
          • start
          • move
          • list-operations
          • list-logs
          • list-backups
          • delete
          • backup
          • remove-labels
          • add-labels
          • update-config
          • update
          • reschedule-maintenance
          • start-failover
          • restore
          • create
          • list
          • get
        • hosts
          • Overview
          • update-config
          • delete
          • update
          • add
          • list
        • database
          • Overview
          • delete
          • update
          • create
          • get
          • list
        • user
          • Overview
          • get
          • list
          • revoke-permission
          • grant-permission
          • delete
          • update
          • create
      • managed-sqlserver
        • Overview
        • backup
          • Overview
          • list
          • get
        • resource-preset
          • Overview
          • list
          • get
        • host
          • Overview
          • list
        • cluster
          • Overview
          • start
          • stop
          • list-operations
          • list-backups
          • backup
          • delete
          • remove-labels
          • add-labels
          • update-config
          • update
          • create
          • restore
          • list
          • get
        • database
          • Overview
          • delete
          • create
          • list
          • get
        • user
          • Overview
          • grant-permission
          • create
          • update
          • list
          • get
          • revoke-permission
          • delete
      • dataproc
        • Overview
        • job
          • Overview
          • create-hive
          • create-mapreduce
          • create-pyspark
          • create-spark
          • log
          • get
          • list
        • resource-preset
          • Overview
          • get
          • list
        • subcluster
          • Overview
          • delete
          • create
          • list
          • get
          • update
        • cluster
          • Overview
          • list-operations
          • list-ui-links
          • list-hosts
          • stop
          • start
          • delete
          • remove-labels
          • add-labels
          • update
          • create
          • list
          • get
      • managed-redis
        • Overview
        • hosts
          • Overview
          • delete
          • add
          • list
        • cluster
          • Overview
          • reschedule-maintenance
          • start-failover
          • restore
          • create
          • list
          • get
          • update
          • stop
          • start
          • move
          • list-operations
          • list-logs
          • list-backups
          • rebalance
          • backup
          • delete
          • remove-labels
          • update-config
          • add-labels
        • resource-preset
          • Overview
          • get
          • list
        • shards
          • Overview
          • delete
          • add
          • list
          • get
        • backup
          • Overview
          • list
          • get
      • managed-elasticsearch
        • Overview
        • cluster
          • Overview
          • remove-labels
          • add-labels
          • update-config
          • update
          • stop
          • start
          • list-operations
          • list-logs
          • delete
          • create
          • list
          • get
        • hosts
          • Overview
          • delete
          • add
          • list
        • resource-preset
          • Overview
          • list
          • get
        • user
          • Overview
          • delete
          • update
          • create
          • list
          • get
      • application-load-balancer
        • Overview
        • backend-group
          • Overview
          • delete-http-backend
          • update-http-backend
          • add-http-backend
          • delete
          • update
          • create
          • list
          • get
        • http-router
          • Overview
          • delete
          • update
          • create
          • list
          • get
        • virtual-host
          • Overview
          • insert-http-route
          • remove-http-route
          • prepend-http-route
          • append-http-route
          • delete
          • update
          • create
          • list
          • get
        • target-group
          • Overview
          • remove-targets
          • add-targets
          • delete
          • update
          • create
          • list
          • get
        • load-balancer
          • Overview
          • get
          • target-states
          • remove-location
          • add-location
          • enable-traffic
          • list-operations
          • disable-traffic
          • update-sni
          • add-sni
          • remove-sni
          • remove-listener
          • update-listener
          • add-listener
          • delete
          • update
          • create
          • list
      • managed-kafka
        • Overview
        • user
          • Overview
          • delete
          • update
          • create
          • list
          • get
        • cluster
          • Overview
          • update
          • create
          • stop
          • start
          • list-hosts
          • list-operations
          • delete
          • list
          • get
        • topic
          • Overview
          • delete
          • update
          • create
          • list
          • get
      • load-balancer
        • Overview
        • network-load-balancer
          • Overview
          • list-operations
          • remove-listener
          • add-listener
          • target-states
          • detach-target-group
          • attach-target-group
          • stop
          • start
          • delete
          • update
          • create
          • list
          • get
        • target-group
          • Overview
          • list-operations
          • remove-targets
          • add-targets
          • delete
          • create
          • update
          • list
          • get
      • iam
        • Overview
        • federation
          • Overview
          • list-operations
          • list-user-accounts
          • add-user-accounts
          • delete
          • update
          • create
          • list
          • get
        • certificate
          • Overview
          • delete
          • list-operations
          • update
          • create
          • get
          • list
        • key
          • Overview
          • delete
          • create
          • list
          • get
        • access-key
          • Overview
          • delete
          • create
          • list
          • get
        • user-account
          • Overview
          • get
        • api-key
          • Overview
          • delete
          • create
          • list
          • get
        • role
          • Overview
          • list
          • get
        • service-account
          • Overview
          • create
          • get
          • list
          • list-operations
          • remove-access-binding
          • add-access-binding
          • set-access-bindings
          • list-access-bindings
          • delete
          • update
        • create-token
      • compute
        • Overview
        • instance
          • Overview
          • list-operations
          • add-one-to-one-nat
          • remove-one-to-one-nat
          • update-network-interface
          • detach-disk
          • attach-new-disk
          • attach-disk
          • restart
          • start
          • stop
          • get-serial-port-output
          • delete
          • remove-labels
          • remove-metadata
          • add-labels
          • add-metadata
          • update-container
          • update
          • create-with-container
          • create
          • list
          • get
        • disk
          • Overview
          • add-labels
          • update
          • create
          • list
          • get
          • list-operations
          • delete
          • resize
          • remove-labels
        • host-type
          • Overview
          • list
          • get
        • disk-placement-group
          • Overview
          • list-operations
          • list-disks
          • delete
          • remove-labels
          • add-labels
          • update
          • create
          • list
          • get
        • host-group
          • Overview
          • list-operations
          • list-instances
          • list-hosts
          • delete
          • remove-labels
          • add-labels
          • update
          • create
          • list
          • get
        • image
          • Overview
          • list-operations
          • delete
          • remove-labels
          • add-labels
          • update
          • create
          • get-latest-from-family
          • list
          • get
        • disk-type
          • Overview
          • list
          • get
        • snapshot
          • Overview
          • list-operations
          • delete
          • remove-labels
          • add-labels
          • update
          • create
          • list
          • get
        • zone
          • Overview
          • list
          • get
        • placement-group
          • Overview
          • list-operations
          • list-instances
          • remove-labels
          • delete
          • add-labels
          • update
          • create
          • list
          • get
        • instance-group
          • Overview
          • stop-instances
          • list-instances
          • delete
          • remove-labels
          • add-labels
          • remove-metadata
          • add-metadata
          • start
          • stop
          • update
          • create
          • list
          • get
          • remove-access-binding
          • add-access-binding
          • set-access-bindings
          • list-access-bindings
          • list-logs
          • list-operations
          • delete-instances
        • connect-to-serial-port
      • managed-kubernetes
        • Overview
        • cluster
          • Overview
          • list-nodes
          • list-operations
          • start
          • stop
          • delete
          • remove-labels
          • update
          • add-labels
          • create
          • list
          • get
          • get-credentials
          • list-node-groups
        • node-group
          • Overview
          • list-nodes
          • list-operations
          • remove-labels
          • delete
          • add-labels
          • remove-metadata
          • add-metadata
          • update
          • create
          • list
          • get
        • list-versions
        • create-token
      • container
        • Overview
        • cluster
          • Overview
          • list-nodes
          • list-operations
          • list-node-groups
          • start
          • stop
          • delete
          • remove-labels
          • add-labels
          • update
          • create
          • list
          • get
          • get-credentials
        • node-group
          • Overview
          • list-nodes
          • list-operations
          • delete
          • remove-labels
          • remove-metadata
          • add-labels
          • add-metadata
          • update
          • create
          • list
          • get
        • registry
          • Overview
          • configure-docker
          • remove-ip-permissions
          • add-ip-permissions
          • set-ip-permissions
          • list-ip-permissions
          • remove-access-binding
          • add-access-binding
          • set-access-bindings
          • list-access-bindings
          • delete
          • remove-labels
          • add-labels
          • update
          • create
          • list
          • get
        • image
          • Overview
          • scan
          • delete
          • list
          • get
          • get-scan-result
          • list-vulnerabilities
          • list-scan-results
          • get-last-scan-result
        • repository
          • Overview
          • lifecycle-policy
            • Overview
            • list-dry-run-affected-images
            • get-dry-run-result
            • list-dry-run-results
            • dry-run
            • delete
            • update
            • create
            • list
            • get
          • list
          • get
          • list-access-bindings
          • remove-access-binding
          • add-access-binding
          • set-access-bindings
      • iot
        • Overview
        • mqtt
          • Overview
          • subscribe
          • publish
        • registry
          • Overview
          • password
            • Overview
            • delete
            • add
            • list
          • certificate
            • Overview
            • add
            • delete
            • list
          • list-device-topic-aliases
          • delete
          • remove-labels
          • add-labels
          • logs
          • update
          • create
          • list
          • get
        • device
          • Overview
          • certificate
            • Overview
            • delete
            • add
            • list
          • password
            • Overview
            • delete
            • add
            • list
          • update
          • create
          • list
          • get
          • delete
          • remove-topic-aliases
          • add-topic-aliases
          • logs
      • serverless
        • Overview
        • api-gateway
          • Overview
          • remove-access-binding
          • add-access-binding
          • set-access-bindings
          • list-access-bindings
          • list-operations
          • delete
          • update
          • create
          • get-spec
          • list
          • get
        • trigger
          • Overview
          • create
            • Overview
            • timer
            • message-queue
            • cloud-logs
            • container-registry
            • object-storage
            • internet-of-things
          • add-labels
          • update
          • list
          • get
          • list-operations
          • resume
          • pause
          • delete
          • remove-labels
        • function
          • Overview
          • version
            • Overview
            • get
            • list
            • logs
            • get-by-tag
            • remove-tag
            • set-tag
            • create
          • runtime
            • Overview
            • list
          • list-access-bindings
          • invoke
          • logs
          • list-operations
          • delete
          • remove-labels
          • add-labels
          • update
          • create
          • list
          • get
          • tag-history
          • set-access-bindings
          • add-access-binding
          • remove-access-binding
          • allow-unauthenticated-invoke
          • deny-unauthenticated-invoke
      • logs
  1. Step-by-step instructions
  2. Authentication
  3. Authenticating as a service account

Authenticating as a service account

  • Before you start
  • Authenticate as a service account
  • Authenticate as a service account from inside a VM

Learn how to authenticate in the CLI:

  • As the service account.
  • As a service account from inside a VM.

Before you start

  1. Authenticate in the CLI as a user.
  2. If you don't have a service account, create one and set up its access rights.

Authenticate as a service account

  1. Get a list of service accounts that exist in your cloud:

    $ yc iam service-account --folder-id <folder ID> list
    +----------------------+------------+
    |          ID          |    NAME    |
    +----------------------+------------+
    | aje3932acd0c5ur7dagp | default-sa |
    +----------------------+------------+
    
  2. Create an authorized key for the service account and save it to the file key.json:

    $ yc iam key create --service-account-name default-sa --output key.json
    id: aje83v701b1un777sh40
    service_account_id: aje3932acd0c5ur7dagp
    created_at: "2019-08-26T12:31:25Z"
    key_algorithm: RSA_2048
    
  3. Add the service account authorized key to the CLI profile.

    1. Create a new CLI profile:

      $ yc config profile create sa-profile
      
    2. Add an authorized key:

      $ yc config set service-account-key key.json
      
  4. Make sure that the service account parameters are added correctly:

    $ yc config list
    service-account-key:
      id: aje83v701b1un777sh40
      service_account_id: aje3932acd0c5ur7dagp
      created_at: "2019-08-26T12:31:25Z"
      key_algorithm: RSA_2048
      public_key: |
        -----BEGIN PUBLIC KEY-----
        MIIBIjANBg...
        -----END PUBLIC KEY-----
      private_key: |
        -----BEGIN PRIVATE KEY-----
        MIIEvwIBAD...
        -----END PRIVATE KEY-----
    
  5. Configure your profile to run commands.

    Some commands require that you specify unique IDs for your cloud and folder. You can specify their details in the profile or use a specific flag for these commands.

    1. Specify the cloud in your profile:

      $ yc config set cloud-id <cloud ID>
      

      Or run commands with the --cloud-id parameter.

    2. Specify a folder in the profile:

      $ yc config set folder-id <folder ID>
      

      Or use the --folder-id parameter in your commands.

    All operations in this profile will be performed on behalf of the linked service account. You can change the profile parameters or switch to another profile.

Authenticate as a service account from inside a VM

The authentication process from inside a VM is simplified for a service account:

  1. Link your service account to a virtual machine.

  2. Authenticate from inside a VM:

    1. Connect to the virtual machine over SSH or via RDP.

    2. If you don't have the Yandex.Cloud command line interface yet, install and initialize it.

    3. Create a new profile:

      yc config profile create my-robot-profile
      
  3. Configure your profile to run commands.

    Some commands require that you specify unique IDs for your cloud and folder. You can specify their details in the profile or use a specific flag for these commands.

    1. Specify the cloud in your profile:

      $ yc config set cloud-id <cloud ID>
      

      Or run commands with the --cloud-id parameter.

    2. Specify a folder in the profile:

      $ yc config set folder-id <folder ID>
      

      Or use the --folder-id parameter in your commands.

    All operations in this profile will be performed on behalf of the linked service account. You can change the profile parameters or switch to another profile.

Read more about working with Yandex.Cloud from a VM in the section Working with Yandex.Cloud from inside a VM.

See also

  • Managing the CLI configuration.
  • Creating a profile.
  • Activating a profile.
  • Managing profile parameters.
  • Working with Yandex.Cloud from inside a VM.
In this article:
  • Before you start
  • Authenticate as a service account
  • Authenticate as a service account from inside a VM
Language / Region
Careers
Privacy policy
Terms of use
Brandbook
© 2021 Yandex.Cloud LLC