Access management
In this section, you'll learn:
- What resources you can assign roles to.
- What roles exist in the service.
- What roles are required for particular actions.
About access management
All transactions in Yandex.Cloud are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.
To grant permission to a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, service account, or system group. For more information, see How access management works in Yandex.Cloud.
Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.
What resources you can assign roles to.
You can assign roles for a cloud, folder, or secret. These roles also apply to nested resources. The diagram shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all viewer role permissions. A description of each role is given under the diagram.
What roles exist in the service
You can manage access to secrets using both service and primitive roles.
Active roles in the service:
- Service roles:
-
lockbox.admin: Lets you manage your secrets and access to them. -
lockbox.editor: Lets you manage a secret and change its contents. -
lockbox.viewer: Lets you read the metadata of the secret. -
lockbox.payloadViewer: The role designed for service accounts that lets you access the contents of the secret. -
resource-manager.clouds.owner: Grants you full access to the cloud and the resources in it. You can only assign this role for a cloud. -
resource-manager.clouds.member: Required to access resources in the cloud for all users except the cloud owners and service accounts.
-
- Primitive roles:
What roles do I need
The table below lists the roles needed to perform a given action. You can always assign a role granting more permissions than the role specified. For example, you can assign editor instead of viewer.
| Action | lockbox.admin |
lockbox.editor |
lockbox.viewer |
lockbox.payloadViewer |
|---|---|---|---|---|
| Create and delete secrets | ✔ | ✔ | - | - |
| Change the metadata of the secret | ✔ | ✔ | - | - |
| Read the metadata of the secret | ✔ | ✔ | ✔ | - |
| Change the content of the secret version | ✔ | ✔ | - | - |
| Read the content of the secret version | ✔ | - | - | ✔ |
| Control access to the secret | ✔ | - | - | - |