Contact UsGet started
Yandex Identity and Access Management

Creating a service account

Written by
Updated at February 9, 2024

Create a service account to manage resources under a different account.

Create a service account

  1. Log in to the management console.

  2. Click the line with the name of the folder where you want to create a service account.

  3. At the top of the screen, go to the Service accounts tab.

  4. Click Create service account.

  5. Enter a name for the service account.

    The name format requirements are as follows:

    • The name must be from 3 to 63 characters long.
    • It may contain lowercase Latin letters, numbers, and hyphens.
    • The first character must be a letter and the last character cannot be a hyphen.

    Make sure the service account name is unique within your cloud.

  6. Click Create.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

  1. Check the description of the command for creating a service account:

    yc iam service-account create --help

  2. Create a service account named my-robot:

    yc iam service-account create --name my-robot

    The name format requirements are as follows:

    • The name must be from 3 to 63 characters long.
    • It may contain lowercase Latin letters, numbers, and hyphens.
    • The first character must be a letter and the last character cannot be a hyphen.

If you don't have Terraform, install it and configure the Yandex Cloud provider.

  1. In the configuration file, describe the parameters of the resources you want to create:

    resource "yandex_iam_service_account" "sa" {
  name        = "<service_account_name>"
  description = "<service_account_description>"
  folder_id   = "<folder_ID>"
}
    • name: Service account name. This is a required parameter.
    • description: Service account description. This is an optional parameter.
    • folder_id: Folder ID. This is an optional parameter. By default, the value specified in the provider settings is used.

    For more information about the yandex_iam_service_account resource parameters in Terraform, see the provider documentation.

  2. Make sure the configuration files are valid.

    1. In the command line, go to the directory where you created the configuration file.

    2. Run a check using this command:

      terraform plan

    If the configuration is specified correctly, the terminal will display information about the service account. If there are errors in the configuration, Terraform points them out.

  3. Deploy cloud resources.

    1. If the configuration does not contain any errors, run this command:

      terraform apply

    2. Confirm creating the service account: type yes in the terminal and press Enter.

      The service account will then be created. You can check the new service account using the management console or this CLI command:

      yc iam service-account list

To create a service account, use the create REST API method for the ServiceAccount resource or the ServiceAccountService/Create gRPC API call.

Examples

Add a description when creating

Create a service account with the following name and description:

yc iam service-account create --name my-robot \
  --description "this is my favorite service account"

 resource "yandex_iam_service_account" "sa" {
   name        = "my-robot"
   description = "this is my favorite service account"
 }

curl -X POST \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer <IAM_token>" \
    -d '{
        "folderId": "b1gvmob95yys********",
        "name": "my-robot",
        "description": "this is my favorite service account"
    }' \
    https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts

Useful links

Previous
Granting group permissions
Next
Updating a service account
In this article: