Access management in Object Storage

In this section, you'll learn:

• What resources you can assign roles to.
• What roles exist in the service.

About access management

All transactions in Yandex Cloud are checked by the Yandex Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.

To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Yandex Cloud.

Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.

What resources you can assign roles to

Using the Yandex Cloud console or the YC CLI, you can assign a role to clouds and folders. These assigned roles will also apply to nested resources.

For information about managing access to buckets and objects, see Access control lists (ACLs).

What roles exist in the service

The diagram shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all viewer role permissions. A description of each role is given under the diagram.

Service roles

Role	Permissions
resource-manager.clouds.member	The role required to access resources in the cloud for all users except cloud owners and service accounts.
resource-manager.clouds.owner	Grants you full access to a cloud and the resources in it. You can only assign this role for a cloud.
storage.admin	Gives the right to manage Object Storage.
storage.configViewer	The role allows users to view the security settings of buckets and objects in them, but doesn't grant them access to data stored in buckets.
storage.configurer	Lets you manage the settings of object lifecycles, static site hosting, access policy, and CORS.
storage.editor	Enables any operation with buckets and the objects in them except for changing versioning settings and access policies, for which the storage.admin role is required.
storage.uploader	Gives the right to upload objects to buckets.
storage.viewer	Gives access to read the list of buckets, their settings, and data in buckets.

For more information about service roles, see Roles in the Yandex Identity and Access Management documentation.

Primitive roles

Role	Permissions
admin	Lets you manage your resources and access to them.
editor	Lets you manage resources (create, edit, and delete).
viewer	Lets you only view information about resources.