Managing access to Managed Service for Elasticsearch
In this section, you'll learn:
- What resources you can assign roles to.
- What roles exist in the service.
- What roles are required for particular actions.
About access management
All transactions in Yandex.Cloud are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.
To grant permission to a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, service account, or system group. For more information, see How access management works in Yandex.Cloud.
Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.
What resources you can assign roles to
As with other services, you can assign roles for clouds, folder, and service accounts. The roles assigned for clouds and folders also apply to nested resources.
To allow access to Managed Service for Elasticsearch service resources (clusters and hosts, cluster backups, and accounts), assign the user the appropriate roles for a folder or cloud hosting the resources.
What roles exist in the service
The diagram shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all viewer role permissions. A description of each role is given under the diagram.
Active roles in the service:
- Service roles:
-
resource-manager.clouds.owner: Grants you full access to the cloud and the resources in it. You can only assign this role for a cloud. -
resource-manager.clouds.member: Required to access resources in the cloud for all users except the cloud owners and service accounts.
-
- Primitive roles:
What roles do I need
The table below shows what you can do with cluster resources and the roles you need to perform them.
| Action | Methods | Required roles |
|---|---|---|
| View data | ||
| View information about the cluster and related resources | get, list |
viewer, editor, or admin for the folder hosting the cluster |
| Manage resources | ||
| Create clusters in the folder | create |
editor or admin for the folder hosting the cluster |
| Change and delete clusters and related resources | update, delete |
editor or admin for the folder hosting the cluster |
| Manage resource access | ||
| Create, edit, or remove cluster accounts | create, update, delete |
editor or admin for the folder hosting the cluster |
| Assign, revoke, and view roles granted for the resource or cloud | setAccessBindings, updateAccessBindings, listAccessBindings |
admin for the folder hosting the cluster or the cloud |