Access management in Identity and Access Management
In this section, you'll learn:
- What resources you can assign the role to.
- What roles exist in the service.
- What roles are required for particular actions.
About access management
All transactions in Yandex.Cloud are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.
To grant permission to a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, service account or system group. For more information, see How access management works in Yandex.Cloud.
Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.
What resources you can assign roles to
As with other services, you can assign roles for clouds, folder and service accounts. The roles assigned for clouds and folders also apply to nested resources.
What roles exist in the service
The diagram shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all viewer role permissions. A description of each role is given under the diagram.
Active roles in the service:
- Service roles:
-
iam.serviceAccounts.user: Verifies the right to use the service account.For some services, you need the service account to perform operations, such as in Instance Groups and Managed Service for Kubernetes. If you have entered a service account in the request, IAM checks that you have rights to use this account.
-
resource-manager.clouds.owner: Grants you full access to the cloud and the resources in it. You can only assign this role for a cloud. -
resource-manager.clouds.member: Required to access resources in the cloud for all users except the cloud owners and service accounts.
-
- Primitive roles:
What roles do I need
The table below lists the roles needed to perform a given action. You can always assign a role granting more permissions than the role specified. For example, you can assign editor instead of viewer.
| Action | Methods | Required roles |
|---|---|---|
| View data | ||
| Get an IAM token | create |
no roles needed, only authentication |
| View user data | get, getByLogin |
no roles needed, only authentication |
| View service account data | get, list, listOperations |
iam.serviceAccounts.user or viewer for the service account |
| View information about any resource | get, list |
viewer for this resource |
| Manage resources | ||
| Create service accounts in the folder | create |
editor for the folder |
| Update and delete service accounts | update, delete |
editor for the service account |
| Create and delete keys for a service account | create, delete |
editor for the service account |
| Manage resource access | ||
| Add a new user to the cloud | setAccessBindings |
admin for the cloud |
| Make a new cloud owner user | setAccessBindings, updateAccessBindings |
resource-manager.clouds.owner for the cloud |
| Grant a role, revoke a role, and view roles granted for the resource | setAccessBindings, updateAccessBindings, listAccessBindings |
admin for the resource |