Access management in Data Transfer
In this section, you will learn:
- Which resources you can assign a role for.
- Which roles exist in the service.
- Which roles are required for particular actions.
To use the service, log in to the management console with a Yandex account or federated account.
About access management
In Yandex Cloud, all transactions are checked in Yandex Identity and Access Management. If a subject does not have the required permission, the service returns an error.
To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Yandex Cloud.
Only users with the admin
, resource-manager.clouds.owner
, or organization-manager.organizations.owner
role for a resource can assign roles for this resource.
Which resources you can assign a role for
You can assign a role for a cloud or folder. Cloud roles also apply to nested folders.
Which roles exist in the service
The chart below shows which roles are available in the service and how they inherit each other's permissions. For example, the editor
role includes all the permissions of viewer
. You can find the description of each role under the chart.
Service roles
data-transfer.auditor
The data-transfer.auditor
role allows you to view the service metadata, including the information on the relevant folder, endpoints, and transfers, as well as on Data Transfer quotas.
Currently, this role can only be assigned for working with a folder or a cloud.
data-transfer.viewer
The data-transfer.viewer
role allows you to view information on the relevant folder, endpoints, and transfers, as well as on Data Transfer quotas.
This role includes the permissions of the data-transfer.auditor
role.
Currently, this role can only be assigned for working with a folder or a cloud.
data-transfer.privateAdmin
The data-transfer.privateAdmin
role allows you to manage endpoints and transfers for transferring data only within Yandex Cloud networks, as well as to view information on the relevant folder and Data Transfer quotas.
Users with this role can:
- View information on transfers, as well as create, modify, delete, activate, use, and deactivate transfers for transferring data within Yandex Cloud networks.
- View information on endpoints, as well as create, modify, and delete endpoints in Yandex Cloud.
- View information on the relevant folder.
- View information on Data Transfer quotas.
This role includes the permissions of the data-transfer.viewer
role.
Currently, this role can only be assigned for working with a folder or a cloud.
data-transfer.admin
The data-transfer.admin
role allows you to manage endpoints and transfers for transferring data within Yandex Cloud networks and over the internet, as well as to view information on the relevant folder and Data Transfer quotas.
Users with this role can:
- View information on transfers, as well as create, modify, delete, activate, use, and deactivate transfers for transferring data both within Yandex Cloud networks and over the internet.
- View information on endpoints, as well as create, modify, and delete endpoints both within and outside Yandex Cloud.
- View information on the relevant folder.
- View information on Data Transfer quotas.
This role includes the permissions of the data-transfer.privateAdmin
role.
Currently, this role can only be assigned for working with a folder or a cloud.
Primitive roles
viewer
The viewer
role grants permission to read resources.
The viewer
role includes all permissions granted by the auditor
role. Unlike auditor
, the viewer
role allows access to service data in read mode.
For example, the viewer
role allows you to perform the following operations:
- View information about a resource.
- Get a list of nested resources, such as a list of VMs in a folder.
- View a list of operations with a resource.
editor
The editor
role grants permissions to perform any operation related to resource management, except assigning roles to other users. The editor
role includes all permissions granted by the viewer
role.
For example, the editor
role lets you perform the following operations:
- Create a resource.
- Update a resource.
- Delete a resource.
admin
The admin
role grants all permissions to manage the resource, including assigning roles to other users. You can assign any role except resource-manager.clouds.owner
.
The admin
role includes all permissions granted by the editor
role.
For example, the admin
role lets you perform the following operations:
- Set permissions to the resource.
- Change permissions to the resource.
Roles required
To use the service, you need the editor
role or higher to the folder that projects are being created in. With the viewer
role, you can only view the list of projects and the contents of files that were downloaded.
To create or edit an endpoint of a managed database, you need the service or primitive viewer
role assigned for the folder hosting a cluster of this managed database.
You can always assign a role granting more permissions than the role specified. For example, assign the admin
role instead of editor
.