Yandex Cloud
  • Services
  • Solutions
  • Why Yandex Cloud
  • Pricing
  • Documentation
  • Contact us
Get started
Language / Region
© 2022 Yandex.Cloud LLC
Yandex Identity and Access Management
  • Getting started
    • How to manage access to resources
    • How to work with service accounts
  • Step-by-step instructions
    • All instructions
    • Users
      • Adding users
      • Getting user ID or email
      • Deleting a user
    • Service accounts
      • Creating a service account
      • Updating a service account
      • Assigning roles to a service account
      • Setting up access rights for a service account
      • Creating static access keys
      • Getting the service account ID
      • Deleting service accounts
    • Roles
      • Assigning roles
      • Viewing assigned roles
      • Revoking roles
    • IAM tokens
      • Getting an IAM token for a Yandex account
      • Getting an IAM token for a service account
      • Getting an IAM token for a federated account
    • Keys
      • Creating API keys
      • Deleting API keys
      • Creating authorized keys
  • Concepts
    • Overview
    • How access management works
      • Overview
      • Roles
      • System groups
      • Resources that roles can be assigned for
    • Authorization
      • Overview
      • IAM token
      • OAuth token
      • API key
      • Authorized keys
      • AWS-compatible access keys
    • Service accounts
    • Identity federations
    • Quotas and limits
  • How to use Yandex Cloud securely
  • Access management
  • Pricing policy
  • API reference
    • Authentication in the API
    • gRPC
      • Overview
      • ApiKeyService
      • IamTokenService
      • KeyService
      • RoleService
      • ServiceAccountService
      • UserAccountService
      • YandexPassportUserAccountService
      • AccessKeyService
      • CertificateService
      • FederationService
      • OperationService
    • REST
      • Overview
      • ApiKey
        • Overview
        • create
        • delete
        • get
        • list
        • listOperations
        • update
      • IamToken
        • Overview
        • create
        • createForServiceAccount
      • Key
        • Overview
        • create
        • delete
        • get
        • list
        • listOperations
        • update
      • Role
        • Overview
        • get
        • list
      • ServiceAccount
        • Overview
        • create
        • delete
        • get
        • list
        • listAccessBindings
        • listOperations
        • setAccessBindings
        • update
        • updateAccessBindings
      • UserAccount
        • Overview
        • get
      • YandexPassportUserAccount
        • Overview
        • getByLogin
      • Operation
        • Overview
        • get
      • AccessKey
        • Overview
        • list
        • get
        • delete
        • update
        • listOperations
        • create
      • Federation
        • Overview
        • list
        • get
        • listUserAccounts
        • delete
        • addUserAccounts
        • update
        • listOperations
        • create
      • Certificate
        • Overview
        • list
        • get
        • delete
        • update
        • listOperations
        • create
  • Questions and answers
    • General questions
    • Logging in and accessing resources
    • All questions on the same page
  1. Access management

Access management in Identity and Access Management

Written by
Yandex Cloud
  • About access management
  • What resources you can assign roles to
  • What roles exist in the service
  • What roles do I need

In this section, you'll learn:

  • What resources you can assign the role to.
  • What roles exist in the service.
  • What roles are required for particular actions.

About access management

All transactions in Yandex Cloud are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.

To grant permission to a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, service account or system group. For more information, see How access management works in Yandex Cloud.

Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.

What resources you can assign roles to

As with other services, you can assign roles for clouds, folder and service accounts. The roles assigned for clouds and folders also apply to nested resources.

What roles exist in the service

The diagram shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all viewer role permissions. A description of each role is given under the diagram.

Active roles in the service:

  • Service roles:
    • iam.serviceAccounts.user: Verifies the right to use the service account.

      For some services, you need the service account to perform operations, such as in Instance Groups and Managed Service for Kubernetes. If you have entered a service account in the request, IAM checks that you have rights to use this account.

    • resource-manager.clouds.owner: Grants you full access to the cloud and the resources in it. You can only assign this role for a cloud.

    • resource-manager.clouds.member is required for everyone except the cloud owners and service accounts to access resources in a cloud not owned by the organization.

  • Primitive roles:
    • viewer: Only lets you view information about the resources.

    • editor: Lets you manage resources (create, edit, and delete).

    • admin: Lets you manage resources and access them.

What roles do I need

The table below lists the roles needed to perform a given action. You can always assign a role granting more permissions than the role specified. For example, you can assign editor instead of viewer.

Action Methods Required roles
View data
Get an IAM token create no roles needed, only authentication
View user data get, getByLogin no roles needed, only authentication
View service account data get, list, listOperations iam.serviceAccounts.user or viewer for the service account
View information about any resource get, list viewer for this resource
Manage resources
Create service accounts in the folder create editor for the folder
Update and delete service accounts update, delete editor for the service account
Create and delete keys for a service account create, delete editor for the service account
Manage resource access
Add a new user to the cloud setAccessBindings admin for the cloud
Make a new cloud owner user setAccessBindings, updateAccessBindings resource-manager.clouds.owner for the cloud
Grant a role, revoke a role, and view roles granted for the resource setAccessBindings, updateAccessBindings, listAccessBindings admin for the resource

What's next

  • How to assign a role.
  • How to revoke a role.
  • Read more about access management in Yandex Cloud.
  • More about role inheritance.

Was the article helpful?

Language / Region
© 2022 Yandex.Cloud LLC
In this article:
  • About access management
  • What resources you can assign roles to
  • What roles exist in the service
  • What roles do I need