In this section, you'll learn:
About access management
All transactions in Yandex.Cloud are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.
To grant permission to a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, service account or system group. For more information, see How access management works in Yandex.Cloud.
Only users with the
resource-manager.clouds.owner role for a resource can assign roles for this resource.
What resources you can assign roles to
What roles exist in the service
The diagram shows which roles are available in the service and how they inherit each other's permissions. For example, the
editor role includes all
viewer role permissions. A description of each role is given under the diagram.
||The role required to access resources in the cloud for all users except cloud owners and service accounts.|
||Grants you full access to a cloud and the resources in it. You can only assign this role for a cloud.|
||Gives the right to manage Object Storage.|
||The role allows users to view the security settings of buckets and objects in them, but doesn't grant them access to data stored in buckets.|
||Lets you manage the settings of object lifecycles, static site hosting, access policy, and CORS.|
||Permits any operations on buckets and objects in them.|
||Gives the right to upload objects to buckets.|
||Gives access to read the list of buckets, their settings, and data in buckets.|
For more information about service roles, see Roles in the Yandex Identity and Access Management documentation.
||Lets you manage your resources and access to them.|
||Lets you manage resources (create, edit, and delete).|
||Lets you only view information about resources.|