Access management in Yandex IoT Core
In this section, you'll learn:
About access management
All transactions in Yandex Cloud are checked by the Yandex Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.
To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Yandex Cloud.
Only users with the admin
or resource-manager.clouds.owner
role for a resource can assign roles for this resource.
What resources you can assign roles to
You can assign a role for a cloud or folder. These roles also apply to nested resources.
What roles exist in the service
The list below shows all roles that are considered when verifying access rights in the Yandex IoT Core service.
Service roles
Role | Permissions |
---|---|
resource-manager.clouds.member |
A role everyone requires to access cloud resources, except for cloud owners and service accounts. |
resource-manager.clouds.owner |
Grants you full access to a cloud and the resources in it. You can only assign this role for a cloud. |
iot.devices.writer |
The role required to send gRPC messages to Yandex IoT Core on behalf of a device. |
iot.registries.writer |
The role required to send gRPC messages to Yandex IoT Core on behalf of a registry. |
For more information about service roles, see Roles in the Yandex Identity and Access Management service documentation.
Primitive roles
Role | Permissions |
---|---|
admin |
Lets you manage your resources and access to them. |
editor |
Lets you manage resources (create, edit, and delete). |
viewer |
Lets you only view information about resources. |