Access management in Cloud Functions
In this section, you will learn:
About access management
In Yandex Cloud, all transactions are checked in Yandex Identity and Access Management. If a subject does not have the required permission, the service returns an error.
To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Yandex Cloud.
Roles for a resource can be assigned by users who have the functions.admin
role or one of the following roles for that resource:
admin
resource-manager.admin
organization-manager.admin
resource-manager.clouds.owner
organization-manager.organizations.owner
Which resources you can assign a role for
As with other services, you can assign roles for clouds, folder and service accounts. The roles assigned for clouds and folders also apply to nested resources.
You can assign a role for a function via the YC CLI or the Yandex Cloud API.
Which roles exist in the service
The list below shows all roles that are considered when verifying access rights in the Cloud Functions service.
Service roles
functions.auditor
The functions.auditor
role enables viewing info on the functions, triggers, and connections to managed databases.
Users with this role can:
- View the list of functions and info on them.
- View the list of triggers and info on them.
- View the list of database connections and info on them.
- View info on granted access permissions for Cloud Functions resources.
functions.viewer
The functions.viewer
role enables viewing info on functions, including the function version code and environment variables, as well as on triggers and connections to managed databases.
Users with this role can:
- View the list of functions and info on them.
- View the function version environment variables and code.
- View the list of triggers and info on them.
- View the list of database connections and info on them.
- View info on granted access permissions for Cloud Functions resources.
- View info on Cloud Functions quotas.
- View info on the relevant cloud.
- View info on the relevant folder.
This role also includes the functions.auditor
permissions.
functions.functionInvoker
The functions.functionInvoker
role enables invoking functions.
functions.editor
The functions.editor
role enables managing functions, triggers, API gateways, and connections to managed databases.
Users with this role can:
- View the list of functions and info on them, create functions and their versions, and modify, invoke, and delete functions.
- View the function version environment variables and code.
- View the list of triggers and info on them, as well as create, stop, run, modify, and delete them.
- View the list of database connections and the info on them, as well as create, modify, and delete database connections and connect to databases through functions.
- Create, modify, and delete API gateways.
- View info on granted access permissions for Cloud Functions resources.
- View info on Cloud Functions quotas.
- View info on the relevant cloud.
- View info on the relevant folder.
This role also includes the functions.viewer
permissions.
functions.mdbProxiesUser
The functions.mdbProxiesUser
role enables connecting to managed databases through functions.
functions.admin
The functions.admin
role enables managing functions, triggers, API gateways, and connections to managed databases, as well as access to those.
Users with this role can:
- View info on the granted access permissions to the Cloud Functions resources and modify such access permissions.
- View the list of functions and info on them, create functions and their versions, and modify, invoke, and delete functions.
- View the function version environment variables and code.
- View the list of triggers and info on them, as well as create, stop, run, modify, and delete them.
- View the list of database connections and the info on them, as well as create, modify, and delete database connections and connect to databases through functions.
- Create, modify, and delete API gateways.
- View info on Cloud Functions quotas.
- View info on the relevant cloud.
- View info on the relevant folder.
This role also includes the functions.editor
permissions.
Primitive roles
auditor
Grants permission to view service configuration and metadata without access to data.
viewer
Enables you to view information about resources.
editor
Allows managing (creating, editing, and deleting) resources.
admin
Allows you to manage your resources and access to them.
For more information about primitive roles, see the Yandex Cloud role reference.