Access management in Compute Cloud
In this section, you will learn:
About access management
In Yandex Cloud, all transactions are checked in Yandex Identity and Access Management. If a subject does not have the required permission, the service returns an error.
To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Yandex Cloud.
Only users with the admin
, resource-manager.clouds.owner
, or organization-manager.organizations.owner
role for a resource can assign roles for this resource.
Which resources you can assign a role for
As with other services, you can assign roles for clouds, folder and service accounts. The roles assigned for clouds and folders also apply to nested resources.
You can also assign a role for individual resources of the service:
- VM
- Disk
- Disk snapshot
- Snapshot schedule
- File storage
- Image
- VM placement group
- Non-replicated disk placement group
- Dedicated host group
- GPU cluster
Which roles exist in the service
The chart below shows which roles are available in the service and how they inherit each other's permissions. For example, the editor
role includes all the permissions of viewer
. You can find the description of each role under the chart.
Service roles
compute.auditor
The compute.auditor
role allows you to view information on Compute Cloud resources and relevant operations, as well as on the amount of used resources and quotas. It does not allow you to access the serial port or serial console of an instance.
- View a list of instances and information on them.
- View a list of instance groups and information on them.
- View a list of instance placement groups and information on them.
- View lists of instances in placement groups.
- View a list of dedicated host groups and information on them.
- View lists of hosts and instances in dedicated host groups.
- View information on GPU clusters and instances included in these clusters.
- View a list of disks and information on them.
- View a list of file storages and information on them.
- View a list of non-replicated disk placement groups and information on them.
- View lists of disks in placement groups.
- View a list of images and information on them.
- View information on image families, on images within families, on the latest family image, as well as on access bindings to image families.
- View a list of disk snapshots and information on them.
- View information on disk snapshot schedules.
- View information on Compute Cloud resource and quota consumption and disk limits in the management console.
- View lists of resource operations for Compute Cloud, as well as information on these operations.
- View information on the status of configuring access via OS Login on instances.
- View information on available platforms.
- View a list of availability zones and information on them.
compute.viewer
The compute.viewer
role allows you to view information on Compute Cloud resources and resource operations, as well as on access bindings to the resources and on the amount of used resources and quotas. This role also grants access to instance metadata and serial port output.
- View the instance serial port output.
- View instance metadata.
- View a list of instances, information on instances and on access bindings to them.
- View a list of instance groups and information on them.
- View a list of instance placement groups, information on instance placement groups and on access bindings to them.
- View lists of instances in placement groups.
- View a list of dedicated host groups, information on dedicated host groups and on access bindings to them.
- View lists of hosts and instances in dedicated host groups.
- View information on GPU clusters and instances included in GPU clusters, as well as the on access bindings to these clusters.
- View a list of disks, information on disks and on access bindings to them.
- View a list of file storages, information on file storages and on access bindings to them.
- View a list of non-replicated disk placement groups, information on non-replicated disk placement groups and on access bindings to them.
- View lists of disks in placement groups.
- View a list of images, information on images and on access bindings to them.
- View information on image families, on images within families, on the latest family image, as well as on access bindings to image families.
- View a list of disk snapshots, information on disk snapshots and on access bindings to them.
- View information on disk snapshot schedules and on access bindings to them.
- View information on Compute Cloud resource and quota consumption and disk limits in the management console.
- View lists of resource operations for Compute Cloud, as well as information on these operations.
- View information on the status of configuring access via OS Login on instances.
- View information on available platforms.
- View a list of availability zones, information on availability zones and on access bindings to them.
This role also includes the compute.auditor
permissions.
compute.editor
The compute.editor
role allows you to manage instances, instance groups, disks, images, GPU clusters, and other Compute Cloud resources.
- Create, modify, start, restart, stop, move, and delete instances.
- View a list of instances, information on instances and on access bindings to them.
- Connect and disconnect disks, file storages, and network interfaces to and from instances, as well as link security groups to instance network interfaces.
- Create instances with custom FQDNs and create multi-interface instances.
- Bind service accounts to instances and activate AWS v1 tokens on instances.
- Use the instance serial port for reading and writing.
- Simulate instance maintenance events.
- View instance metadata.
- View information on the status of configuring access via OS Login on instances and connect to instances via OS Login using SSH certificates or SSH keys.
- View a list of instance groups, information on instance groups and on access bindings to them, as well as use, create, modify, start, stop, and delete instance groups.
- View a list of instance placement groups, information on instance placement groups and on access bindings to them, as well as use, modify, and delete instance placement groups.
- View lists of instances in placement groups.
- View a list of dedicated host groups, information on dedicated host groups and on access bindings to them, as well as use, modify, and delete dedicated host groups.
- View lists of hosts and instances in dedicated host groups.
- Modify scheduled maintenance windows for hosts in dedicated host groups.
- Use GPU clusters, as well as create, modify, and delete them.
- View information on GPU clusters and instances included in GPU clusters, as well as the on access bindings to these clusters.
- View a list of disks, information on disks and on access bindings to them, as well as use, modify, move, and delete disks.
- Create encrypted disks.
- View and update disk links.
- View a list of file storages, information on file storages and on access bindings to them, as well as use, create, modify, and delete file storages.
- View a list of non-replicated disk placement groups, information on non-replicated disk placement groups and on access bindings to them, as well as use, modify, and delete non-replicated disk placement groups.
- View lists of disks in placement groups.
- View a list of images, information on images and on access bindings to them, as well as use, modify, and delete images.
- Create, modify, delete, and update image families.
- View information on image families, on images within families, on the latest family image, as well as on access bindings to image families.
- View a list of disk snapshots, information on disk snapshots and on access bindings to them, as well as use, modify, and delete disk snapshots.
- View information on disk snapshot schedules and on access bindings to them, as well as create, modify, and delete disk snapshot schedules.
- View information on cloud networks and use them.
- View information on subnets and use them.
- View information on cloud resource addresses and use them.
- View information on route tables and use them.
- View information on security groups and use them.
- View information on NAT gateways and connect them to route tables.
- View information on the IP addresses used in subnets.
- View information on resource operations for Virtual Private Cloud.
- View information on Virtual Private Cloud quotas.
- View information on Compute Cloud resource and quota consumption and disk limits in the management console.
- View lists of resource operations for Compute Cloud and information on operations, as well as abort such operations.
- View information on available platforms and use them.
- View a list of availability zones, information on availability zones and on access bindings to them.
- View information on the relevant cloud.
- View information on the relevant folder.
This role also includes the compute.viewer
, compute.osLogin
, and vpc.user
permissions.
compute.admin
The compute.admin
role allows you to manage instances, instance groups, disks, images, GPU clusters, and other Compute Cloud resources, as well as manage access to them.
- Create, modify, start, restart, stop, move, and delete instances, as well as manage access to them.
- View a list of instances, information on instances and on access bindings to them.
- Connect and disconnect disks, file storages, and network interfaces to and from instances, as well as link security groups to instance network interfaces.
- Create instances with custom FQDNs and create multi-interface instances.
- Bind service accounts to instances and activate AWS v1 tokens on instances.
- Use the instance serial port for reading and writing.
- Simulate instance maintenance events.
- View instance metadata.
- View information on the status of configuring access via OS Login on instances and connect to instances via OS Login using SSH certificates or SSH keys and run commands as a superuser (
sudo
). - Use, create, modify, start, stop, and delete instance groups, as well as manage access to instance groups.
- View a list of instance groups, information on instance groups and on access bindings to them.
- Use, create, modify, and delete instance placement groups, as well as manage access to instance placement groups.
- View a list of instance placement groups, information on instance placement groups and on access bindings to them.
- View lists of instances in placement groups.
- Use, create, modify, and delete dedicated host groups, as well as manage access to dedicated host groups.
- View a list of dedicated host groups, information on dedicated host groups and on access bindings to them.
- View lists of hosts and instances in dedicated host groups.
- Modify scheduled maintenance windows for hosts in dedicated host groups.
- Use, create, modify, and delete GPU clusters, as well as manage access to them.
- View information on GPU clusters and instances included in GPU clusters, as well as the on access bindings to these clusters.
- Use, create, modify, move, and delete disks, as well as manage access to them.
- Create encrypted disks.
- View a list of disks, information on disks and on access bindings to them.
- View and update disk links.
- Use, create, modify, and delete file storages, as well as manage access to them.
- View a list of file storages, information on file storages and on access bindings to them.
- Use, create, modify, and delete non-replicated disk placement groups, as well as manage access to non-replicated disk placement groups.
- View a list of non-replicated disk placement groups, information on non-replicated disk placement groups and on access bindings to them.
- View lists of disks in placement groups.
- Use, create, modify, and delete images, as well as manage access to them.
- View a list of images, information on images and on access bindings to them.
- Create, modify, delete, and update image families, as well as manage access to them.
- View information on image families, on images within families, on the latest family image, as well as on access bindings to image families.
- Use, create, modify, and delete disk snapshots, as well as manage access to them.
- View a list of disk snapshots, information on disk snapshots and on access bindings to them.
- Create, modify, and delete disk snapshot schedules, as well as manage access to them.
- View information on disk snapshot schedules and on access bindings to them.
- View information on cloud networks and use them.
- View information on subnets and use them.
- View information on cloud resource addresses and use them.
- View information on route tables and use them.
- View information on security groups and use them.
- View information on NAT gateways and connect them to route tables.
- View information on the IP addresses used in subnets.
- View information on resource operations for Virtual Private Cloud.
- View information on Virtual Private Cloud quotas.
- View information on Compute Cloud resource and quota consumption and disk limits in the management console.
- View lists of resource operations for Compute Cloud and information on operations, as well as abort such operations.
- View information on available platforms and use them.
- View a list of availability zones, information on availability zones and on access bindings to them.
- View information on the relevant cloud.
- View information on the relevant folder.
This role also includes the compute.editor
and compute.osAdminLogin
permissions.
compute.osLogin
The compute.osLogin
role allows you to connect to instances via OS Login using SSH certificates or SSH keys.
compute.osAdminLogin
The compute.osAdminLogin
role allows you to connect to instances using SSH certificates or SSH keys via OS Login and run commands as a superuser (sudo
).
compute.disks.user
The compute.disks.user
role allows you to view a list of disks and information on them, as well as use disks to create new resources, such as instances.
compute.images.user
The compute.images.user
role allows you to view a list of images and information on them, get information on the latest image within the image family, as well as use images to create new resources, such as instances.
compute.operator
The compute.operator
role allows you to start and stop instances and instance groups, as well as view information on Compute Cloud resources and resource operations, as well as on access bindings to the resources and the amount of used resources and quotas.
- Start, restart, and stop instances.
- View a list of instances, information on instances and on access bindings to them.
- Start and stop instance groups.
- View a list of instance groups and information on them.
- View the instance serial port output.
- View instance metadata.
- View a list of instance placement groups, information on instance placement groups and on access bindings to them.
- View lists of instances in placement groups.
- View a list of dedicated host groups, information on dedicated host groups and on access bindings to them.
- View lists of hosts and instances in dedicated host groups.
- View information on GPU clusters and instances included in GPU clusters, as well as the on access bindings to these clusters.
- View a list of disks, information on disks and on access bindings to them.
- View a list of file storages, information on file storages and on access bindings to them.
- View a list of non-replicated disk placement groups, information on non-replicated disk placement groups and on access bindings to them.
- View lists of disks in placement groups.
- View a list of images, information on images and on access bindings to them.
- View information on image families, on images within families, on the latest family image, as well as on access bindings to image families.
- View a list of disk snapshots, information on disk snapshots and on access bindings to them.
- View information on disk snapshot schedules and on access bindings to them.
- View information on Compute Cloud resource and quota consumption and disk limits in the management console.
- View lists of resource operations for Compute Cloud, as well as information on these operations.
- View information on the status of configuring access via OS Login on instances.
- View information on available platforms.
- View a list of availability zones, information on availability zones and on access bindings to them.
This role also includes the compute.viewer
permissions.
compute.snapshotSchedules.viewer
The compute.snapshotSchedules.viewer
role allows you to view information on scheduled disk snapshots.
Users with this role can:
- View information on disk snapshot schedules and on access bindings to them.
- View lists of disks.
- View lists of disk snapshots.
- View a list of disk snapshot operations.
compute.snapshotSchedules.editor
The compute.snapshotSchedules.editor
role allows you to create, modify, and delete disk snapshot schedule, create and delete disk snapshots, as well as view information on disk snapshot operations.
Users with this role can:
- View information on disk snapshot schedules and on access bindings to them, as well as create, modify, and delete disk snapshot schedules.
- View lists of disks and use disks to create snapshots.
- View lists of disk snapshots, create and delete snapshots.
- View a list of disk snapshot operations and information on them.
This role also includes the compute.snapshotSchedules.viewer
permissions.
iam.serviceAccounts.user
The iam.serviceAccounts.user
role enables viewing the list of service accounts and info on them, as well as performing operations on behalf of a service account.
For example, if you specify a service account when creating an instance group, IAM will check whether you have a permission to use this service account.
For more information about service roles, see Roles in the Yandex Identity and Access Management service documentation.
Primitive roles
auditor
Grants permission to view service configuration and metadata without access to data.
viewer
Enables you to view information about resources.
editor
Allows managing (creating, editing, and deleting) resources.
admin
Allows you to manage your resources and access to them.
For more information about primitive roles, see the Yandex Cloud role reference.