Configuring access to a secret

Written by

Yandex Cloud

Updated at October 17, 2024

Management console

CLI

Terraform

API

In the management console, select the folder the secret belongs to.
In the list of services, select Lockbox.
Click the name of the secret you need.
On the left-hand panel, select Access bindings and click Assign bindings.
In the window that opens, click Select subject.
Select the group, user, or service account to be granted access to the secret.
Click Add role and select the required roles.
Click Save.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

Get the secret ID (the ID column in the command output):

yc lockbox secret list

Result:

+----------------------+-------------+------------+---------------------+----------------------+--------+
|          ID          |    NAME     | KMS KEY ID |     CREATED AT      |  CURRENT VERSION ID  | STATUS |
+----------------------+-------------+------------+---------------------+----------------------+--------+
| e6qetpqfe8vvag9h7jkr | test-secret |            | 2023-12-06 15:12:13 | e6qdnt9t2qsdggusve4g | ACTIVE |
+----------------------+-------------+------------+---------------------+----------------------+--------+

To assign a role for a secret:

To a user:

yc lockbox secret add-access-binding \
  --id <secret_ID> \
  --user-account-id <user_ID> \
  --role <role>

Where:

--id: Secret ID.
--user-account-id: User ID.
--role: Role being assigned.

To a service account:

yc lockbox secret add-access-binding \
  --id <secret_ID> \
  --service-account-id <service_account_ID> \
  --role <role>

Where:

--id: Secret ID.
--service-account-id: Service account ID.
--role: Role being assigned.

If you don't have Terraform, install it and configure the Yandex Cloud provider.

In the configuration file, describe the properties of access to the secret:
```
resource "yandex_lockbox_secret_iam_binding" "secret-viewer" {
  secret_id = "<secret_ID>"
  role      = "<role>"

  members = [
    "serviceAccount:<service_account_1_ID>",
    "serviceAccount:<service_account_2_ID>"
  ]
}
```
Where:
- secret_id: Secret ID.
- role: Role being assigned.
- members: IDs of users, groups, or service accounts to be assigned the role.
For more information about the yandex_lockbox_secret_iam_binding resource parameters in Terraform, see the provider documentation.
Create resources
1. In the terminal, change to the folder where you edited the configuration file.
2. Make sure the configuration file is correct using the command:
```
terraform validate
```
  If the configuration is correct, the following message is returned:
```
Success! The configuration is valid.
```
3. Run the command:
```
terraform plan
```
  The terminal will display a list of resources with parameters. No changes are made at this step. If the configuration contains errors, Terraform will point them out.
4. Apply the configuration changes:
```
terraform apply
```
5. Confirm the changes: type yes in the terminal and press Enter.
Terraform will create all the required resources. You can check the new resources and their configuration using the management console or this CLI command:
```
yc lockbox secret list-access-binding <secret_ID>
```

To configure access to a secret, use the setAccessBindings REST API method for the Secret resource or the SecretService/SetAccessBindings gRPC API call.

Warning

If you assign a group, user, or service account a role for a folder or cloud where the secret is stored, all permissions of this role will also apply to the secret.

For more information, see How access management works.

Configuring access to a secret

See also

Was the article helpful?

Configuring access to a secret

See alsoSee also

Was the article helpful?

See also