Access management in Managed Service for Apache Kafka®
In this section, you'll learn:
- What resources you can assign roles to.
- What roles exist in the service.
- What roles are required for particular actions.
About access management
All transactions in Yandex.Cloud are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.
To grant permission to a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, service account or system group. For more information, see How access management works in Yandex.Cloud.
Only users with the
resource-manager.clouds.owner role for a resource can assign roles for this resource.
What resources you can assign roles to
To allow access to Managed Service for Apache Kafka® service resources (clusters and hosts, cluster backups, partitions and topics, and accounts), assign the user the appropriate roles for the folder or cloud hosting the resources.
What roles exist in the service
The diagram shows which roles are available in the service and how they inherit each other's permissions. For example, the
editor role includes all the permissions of
viewer. A description of each role is given under the diagram.
Active roles in the service:
||Lets you create and modify managed database clusters.|
Roles of other Yandex.Cloud services
||Grants you full access to a cloud and the resources in it. You can only assign this role for a cloud.|
||Everyone needs this role to access cloud resources, except cloud owners and owners of service accounts.|
||Lets you manage external connectivity. Important: if a network and a subnet are in different folders, you can check for the presence of this role in the folder where the network is hosted. For more information, see Virtual Private Cloud roles.|
||Lets you manage your resources and access to them.|
||Lets you manage resources (create, edit, and delete).|
||Lets you only view information about resources.|
What roles do I need
The table below lists the roles needed to perform a given action. You can always assign a role granting more permissions than the role specified. For example, you can assign
editor instead of
|View information about the cluster and related resources||
|Create clusters in the folder||
|Creating clusters with public access enabled||
|Change and delete clusters and related resources||
|Manage resource access|
|Create, update, and delete cluster accounts||
|Assign, revoke, and view roles granted for the resource or cloud||