Access management

In this section, you'll learn:

• What resources you can assign roles to.
• What roles exist in the service.
• What roles are required for particular actions.

About access management

All transactions in Yandex.Cloud are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.

To grant permission to a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, service account or system group. For more information, see How access management works in Yandex.Cloud.

Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.

What resources you can assign roles to

As with other services, you can assign roles for clouds, folder and service accounts. The roles assigned for clouds and folders also apply to nested resources.

What roles exist in the service

The diagram shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all viewer role permissions. A description of each role is given under the diagram.

Active roles in the service:

• Service roles:

  • resource-manager.clouds.owner: Grants you full access to the cloud and the resources in it. You can only assign this role for a cloud.

  • resource-manager.clouds.member: Required to access resources in the cloud for all users except the cloud owners and service accounts.

  • vpc.viewer: Lets you view resource model objects.

  • vpc.user: Lets you connect to network resources and use them.

  • vpc.privateAdmin: Lets you manage connectivity within Yandex.Cloud, but not from the internet.

  • vpc.publicAdmin: Lets you manage external connectivity. Important: if a network and subnet are in different folders, the vpc.publicAdmin role is checked for the folder where the network is located.

  • vpc.securityGroups.admin: Lets you manage security groups.

  • vpc.admin is a network administrator role that combines vpc.privateAdmin, vpc.publicAdmin, and vpc.securityGroups.admin.

• Primitive roles:

  • viewer: Only lets you view information about the resources.

  • editor: Lets you manage resources (create, edit, and delete).

  • admin: Lets you manage resources and access them.

What roles do I need

The table below lists the roles needed to perform a given action. You can always assign a role granting more permissions than the role specified. For example, assign editor instead of viewer or vpc.admin instead of vpc.publicAdmin.

Action	Methods	Required roles
View data
View information about any resource	get, list, listOperations	vpc.viewer or viewer for this resource
List subnets in the network	listSubnets	vpc.viewer or viewer for the network
Use of resources
Assign VPC resources to other Yandex.Cloud resources (for example, assigning an address to an interface or connecting a network interface to a subnet)	Various	vpc.user for the resource and the right to change the receiving object if the resource assignment operation is mutating
Assign or delete the public address of an interface	various	vpc.publicAdmin for the network
Creating a VM connected to multiple networks	create	vpc.publicAdmin for each network the VM is connecting to
Manage resources
Create networks in a folder	create	vpc.privateAdmin or editor for the folder
Update, and delete networks	update, delete	vpc.privateAdmin or editor for the network
Create subnets in a folder	create	vpc.privateAdmin or editor for the folder and network
Update and delete subnets	update, delete	vpc.privateAdmin or editor for the folder
Create a route table	create	vpc.privateAdmin or editor for the folder
Update or delete a route table	update, delete	vpc.privateAdmin or editor for the route table
Create public addresses	create	vpc.publicAdmin or editor for the folder
Delete public addresses	delete	vpc.publicAdmin or editor for the address
Enable NAT to the internet		vpc.publicAdmin or editor for the subnet
Create security groups	create	vpc.securityGroups.admin or editor for the folder and network
Update and delete security groups	update, delete	vpc.securityGroups.admin or editor for the network and security group
Manage resource access
Assign, revoke, and view roles granted for the resource	setAccessBindings, updateAccessBindings, listAccessBindings	admin for the resource

What's next

• How to assign a role.
• How to revoke a role.
• Learn more about access management in Yandex.Cloud.
• For more information about role inheritance.