Access management
Note
This feature is in the Preview stage.
In this section, you will learn:
- Which resources you can assign a role for.
- Which roles exist in the service.
- Which roles are required for particular actions.
About access management
In Yandex Cloud, all transactions are checked in Yandex Identity and Access Management. If a subject does not have the required permission, the service returns an error.
To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Yandex Cloud.
Only users with the admin
, resource-manager.clouds.owner
, or organization-manager.organizations.owner
role for a resource can assign roles for this resource.
Which resources you can assign a role for
As with other services, you can assign roles for clouds, folder and service accounts. The roles assigned for clouds and folders also apply to nested resources.
You can assign a role for a connection in the management console.
Roles existing in Connection Manager
You can use Yandex MetaData Hub roles (service roles) and Yandex Cloud roles (primitive roles) to manage connection access permissions.
Service roles for managing connections using Yandex Connection Manager
connection-manager.auditor
The connection-manager.auditor
role allows you to view public details on connections and access bindings to them. If you have this role assigned for a cloud, it will also enable viewing Connection Manager quotas.
connection-manager.viewer
The connection-manager.viewer
role enables viewing info on connections and access bindings to them, as well as on the Connection Manager quotas. It does not allow you to view private data, such as DB passwords.
This role also includes the connection-manager.auditor
permissions.
connection-manager.editor
The connection-manager.editor
role allows you to manage connections and view their details, including private data such as DB passwords.
Users with this role can:
- Create, use, edit, and delete connections.
- View connection details, including private data and info on access bindings.
- View info on Connection Manager quotas.
This role also includes the connection-manager.viewer
permissions.
connection-manager.admin
The connection-manager.admin
role allows you to manage connections and access to those, as well as view connection details, including private data such as DB passwords.
Users with this role can:
- Create, use, edit, and delete connections, as well as manage access to them.
- View connection details, including private data and info on access bindings.
- View info on Connection Manager quotas.
This role also includes the connection-manager.editor
permissions.
Primitive roles
auditor
Grants permission to view service configuration and metadata without access to data.
viewer
Enables you to view information about resources.
editor
Allows managing (creating, editing, and deleting) resources.
admin
Allows you to manage your resources and access to them.
For more information about primitive roles, see the Yandex Cloud role reference.
What roles do I need
The table below lists the roles needed to perform a particular action. You can always assign a role granting more permissions than the role specified. For example, you can assign the editor
role instead of viewer
.
Action | Required roles |
---|---|
Getting information about connections | connection-manager.viewer |
Getting a list of connections | connection-manager.viewer |
Creating a connection | connection-manager.editor |
Editing a connection | connection-manager.editor |
Deleting a connection | connection-manager.editor |
Setting connection access permissions | connection-manager.admin |
Changing connection access permissions | connection-manager.admin |