Yandex Cloud
  • Services
  • Solutions
  • Why Yandex Cloud
  • Blog
  • Pricing
  • Documentation
  • Contact us
Get started
Language / Region
Yandex project
© 2023 Yandex.Cloud LLC
Yandex IoT Core
  • Getting started
  • Step-by-step instructions
    • All instructions
    • Sending messages
    • Subscribing a device or registry to receive messages
    • Viewing the connection log
    • Creating a trigger for a topic
    • Managing registries
      • Getting information about registries
      • Creating a registry
      • Updating a registry
      • Deleting a registry
    • Managing devices
      • Managing topic aliases
        • Creating an alias
        • Getting a list of aliases
        • Updating an alias
        • Deleting an alias
      • Getting information about devices
      • Creating a device
      • Updating a device
      • Deleting a device
    • Managing brokers
      • Getting information about a broker
      • Creating a broker
      • Updating a broker
      • Deleting a broker
    • Managing certificates
      • Create a certificate
      • Managing registry certificates
      • Managing device certificates
      • Managing broker certificates
    • Managing passwords
      • Managing registry passwords
      • Managing device passwords
      • Managing broker passwords
  • Concepts
    • Authorization
    • Relationship between service resources
    • MQTT server connection parameters
    • Sending messages to an MQTT server via gRPC
    • Topic
      • Overview
      • Device topics
      • Registry topics
      • Subtopic
      • Using topics
    • Backups
    • Quotas and limits
  • Practical guidelines
    • All tutorials
    • Working with Mosquitto
      • Sending messages
      • Subscribing a device or registry to receive messages
    • Working with Yandex IoT Core from an Android device in Java
    • Working with Yandex IoT Core in C#
    • Working with Yandex IoT Core in Java
    • Writing data from a device to Managed Service for PostgreSQL
  • Access management
  • Pricing policy
  • Devices API reference
    • Authentication in the API
    • gRPC
      • Overview
      • DeviceDataService
      • DeviceService
      • RegistryDataService
      • RegistryService
      • OperationService
    • REST
      • Overview
      • DeviceData
        • Overview
        • publish
      • Device
        • Overview
        • addCertificate
        • addPassword
        • create
        • delete
        • deleteCertificate
        • deletePassword
        • get
        • getByName
        • list
        • listCertificates
        • listOperations
        • listPasswords
        • update
      • RegistryData
        • Overview
        • publish
      • Registry
        • Overview
        • addCertificate
        • addPassword
        • create
        • delete
        • deleteCertificate
        • deletePassword
        • get
        • getByName
        • list
        • listCertificates
        • listDeviceTopicAliases
        • listOperations
        • listPasswords
        • update
  • Broker API reference
    • Authentication in the API
    • gRPC
      • Overview
      • BrokerDataService
      • BrokerService
      • OperationService
    • REST
      • Overview
      • BrokerData
        • Overview
        • publish
      • Broker
        • Overview
        • addCertificate
        • addPassword
        • create
        • delete
        • deleteCertificate
        • deletePassword
        • get
        • list
        • listCertificates
        • listOperations
        • listPasswords
        • update
  • Questions and answers
  1. Access management

Access management in Yandex IoT Core

Written by
Yandex Cloud
  • About access management
  • What resources you can assign roles to
  • What roles exist in the service
    • Service roles
    • Primitive roles

In this section, you'll learn:

  • Which resources you can assign roles to.
  • Which roles exist in the service.

About access management

All transactions in Yandex Cloud are checked by the Yandex Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.

To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Yandex Cloud.

Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.

What resources you can assign roles to

You can assign a role for a cloud or folder. These roles also apply to nested resources.

What roles exist in the service

The list below shows all roles that are considered when verifying access rights in the Yandex IoT Core service.

Service roles

Role Permissions
resource-manager.clouds.member A role everyone requires to access cloud resources, except for cloud owners and service accounts.
resource-manager.clouds.owner Grants you full access to a cloud and the resources in it. You can only assign this role for a cloud.
iot.devices.writer The role required to send gRPC messages to Yandex IoT Core on behalf of a device.
iot.registries.writer The role required to send gRPC messages to Yandex IoT Core on behalf of a registry.

For more information about service roles, see Roles in the Yandex Identity and Access Management service documentation.

Primitive roles

Role Permissions
admin Lets you manage your resources and access to them.
editor Lets you manage resources (create, edit, and delete).
viewer Lets you only view information about resources.

Was the article helpful?

Language / Region
Yandex project
© 2023 Yandex.Cloud LLC
In this article:
  • About access management
  • What resources you can assign roles to
  • What roles exist in the service
  • Service roles
  • Primitive roles