Contact UsGet started

Configuring access permissions for a digital signature key pair

Written by
Updated at November 21, 2024

You can grant access to an asymmetric digital signature key pair to a user, service account, or user group. To do this, assign rolesfor the digital signature key pair. To choose the ones you need, learn about the service's roles.

Assigning a role

  1. In the management console, select a folder containing an asymmetric encryption key pair.
  2. In the list of services, select Key Management Service.
  3. In the left-hand panel, select Asymmetric keys.
  4. On the Signature tab, click the name of the key pair.
  5. Go to Access bindings and click Assign bindings.
  6. Select the group, user, or service account you want to grant access to the key pair.
  7. Click Add role and select the required roles.
  8. Click Save.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

To assign a role for an asymmetric digital signature key pair:

  1. See the description of the CLI role assignment command:

    yc kms asymmetric-signature-key add-access-binding --help

  2. Get a list of digital signature key pairs with their IDs:

    yc kms asymmetric-signature-key list

  3. Get the ID of the user, service account, or user group you are assigning a role to.

  4. Use one of these commands to assign a role:

    • To a user:

      yc kms asymmetric-signature-key add-access-binding \
   --id <key_pair_ID> \
   --role <role> \
   --user-account-id <user_ID>

    • To a federated user:

      yc kms asymmetric-signature-key add-access-binding \
   --id <key_pair_ID> \
   --role <role> \
   --subject federatedUser:<user_ID>

    • To a service account:

      yc kms asymmetric-signature-key add-access-binding \
   --id <key_pair_ID> \
   --role <role> \
   --service-account-id <service_account_ID>

    • To a user group:

      yc kms asymmetric-signature-key add-access-binding \
   --id <key_pair_ID> \
   --role <role> \
   --subject group:<group_ID>

Use the AsymmetricSignatureKeyService/UpdateAccessBindings gRPC API call and provide the following in the request:

  • ADD value in the access_binding_deltas[].action parameter to add a role.
  • Role in the access_binding_deltas[].access_binding.role_id parameter.
  • ID of the subject you are assigning the role to in the access_binding_deltas[].access_binding.subject.id parameter.
  • Type of the subject you are assigning the role to in the access_binding_deltas[].access_binding.subject.type parameter.

Assigning multiple roles

  1. In the management console, select a folder containing an asymmetric encryption key pair.
  2. In the list of services, select Key Management Service.
  3. In the left-hand panel, select Asymmetric keys.
  4. On the Signature tab, click the name of the key pair.
  5. Go to Access bindings and click Assign bindings.
  6. Select the group, user, or service account you want to grant access to the key pair.
  7. Click Add role and select the required roles.
  8. Click Save.

Alert

The set-access-bindings command for assigning multiple roles completely rewrites access permissions for the resource. All current resource roles will be deleted.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

To assign multiple roles for a digital signature key pair:

  1. Make sure the key pair has no roles assigned that you would not want to lose:

    yc kms asymmetric-signature-key list-access-bindings \
   --id <key_pair_ID>

  2. See the description of the CLI role assignment command:

    yc kms asymmetric-signature-key set-access-bindings --help

  3. Get a list of digital signature key pairs with their IDs:

    yc kms asymmetric-signature-key list

  4. Get the ID of the user, service account, or user group you are assigning roles to.

  5. Use one of the commands below to assign roles:

    • To a Yandex account user:

      yc kms asymmetric-signature-key set-access-bindings \
   --id <key_pair_ID> \
   --access-binding role=<role>,user-account-id=<user_ID>

    • To a federated user:

      yc kms asymmetric-signature-key set-access-bindings \
   --id <key_pair_ID> \
   --access-binding role=<role>,subject=federatedUser:<user_ID>

    • To a service account:

      yc kms asymmetric-signature-key set-access-bindings \
   --id <key_pair_ID> \
   --access-binding role=<role>,service-account-id=<service_account_ID>

    • To a user group:

      yc kms asymmetric-signature-key set-access-bindings \
   --id <key_pair_ID> \
   --access-binding role=<role>,subject=group:<group_ID>

    Provide a separate --access-binding flag for each role. Example:

    yc kms asymmetric-signature-key set-access-bindings \
   --id <key_pair_ID> \
   --access-binding role=<role_1>,service-account-id=<service_account_ID> \
   --access-binding role=<role_2>,service-account-id=<service_account_ID> \
   --access-binding role=<role_3>,service-account-id=<service_account_ID>

Alert

The setAccessBindings method for assigning multiple roles completely rewrites access permissions for the resource. All current resource roles will be deleted.

Use the AsymmetricSignatureKeyService/SetAccessBindings gRPC API call. In your request, provide an array of objects, each one corresponding to a particular role and containing the following data:

  • Role in the access_bindings[].role_id parameter.
  • ID of the subject getting the roles in the access_bindings[].subject.id parameter.
  • Type of the subject getting the roles in the access_bindings[].subject.type parameter.
Previous
Digital signature key pair
Next
Digital signature and its verification