Configuring access to a secret

Written by

Yandex Cloud

Updated at May 5, 2025

Management console

CLI

Terraform

API

In the management console, select the folder the secret belongs to.
From the list of services, select Lockbox.
Click the name of the secret you need.
On the left-hand panel, select Access bindings and click Assign roles.
In the window that opens, click Select subject.
Select the group, user, or service account to grant access to the secret.
Click Add role and select the required roles.
Click Save.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

Get the secret ID (the ID column in the command output):

yc lockbox secret list

Result:

+----------------------+-------------+------------+---------------------+----------------------+--------+
|          ID          |    NAME     | KMS KEY ID |     CREATED AT      |  CURRENT VERSION ID  | STATUS |
+----------------------+-------------+------------+---------------------+----------------------+--------+
| e6qetpqfe8vvag9h7jkr | test-secret |            | 2023-12-06 15:12:13 | e6qdnt9t2qsdggusve4g | ACTIVE |
+----------------------+-------------+------------+---------------------+----------------------+--------+

To assign a role for a secret:

To a user:

yc lockbox secret add-access-binding \
  --id <secret_ID> \
  --user-account-id <user_ID> \
  --role <role>

Where:

--id: Secret ID.
--user-account-id: User ID.
--role: Role.

To a service account:

yc lockbox secret add-access-binding \
  --id <secret_ID> \
  --service-account-id <service_account_ID> \
  --role <role>

Where:

--id: Secret ID.
--service-account-id: Service account ID.
--role: Role.

If you do not have Terraform yet, install it and configure its Yandex Cloud provider.

Describe access permissions for the secret in the Terraform configuration file:
```
resource "yandex_lockbox_secret_iam_member" "secret-viewer" {
  secret_id = "<secret_ID>"
  role      = "<role>"

  members = [
    "serviceAccount:<service_account_1_ID>",
    "serviceAccount:<service_account_2_ID>"
  ]
}
```
Where:
- secret_id: Secret ID.
- role: Role.
- members: List of types and IDs of subjects getting the role. Use this format: userAccount:<user_ID> or serviceAccount:<service_account_ID>.
For more information about yandex_lockbox_secret_iam_member settings, see this Terraform article.
Create the resources
1. In the terminal, change to the folder where you edited the configuration file.
2. Make sure the configuration file is correct using the command:
```
terraform validate
```
  If the configuration is correct, the following message is returned:
```
Success! The configuration is valid.
```
3. Run the command:
```
terraform plan
```
  The terminal will display a list of resources with parameters. No changes are made at this step. If the configuration contains errors, Terraform will point them out.
4. Apply the configuration changes:
```
terraform apply
```
5. Confirm the changes: type yes in the terminal and press Enter.
Terraform will create all required resources. You can check your new resources and their settings in the management console or using this CLI command:
```
yc lockbox secret list-access-binding <secret_ID>
```

To configure access to a secret, use the setAccessBindings REST API method for the Secret resource or the SecretService/SetAccessBindings gRPC API call.

Warning

If you assign a group, user, or service account a role for a folder or cloud where the secret is stored, all permissions of this role will also apply to the secret.

For more information, see How access management works.

Configuring access to a secret

See also

Was the article helpful?

Configuring access to a secret

See alsoSee also

Was the article helpful?

See also