Access management
Note
This feature is in the Preview stage.
In this section, you will learn:
- Which resources you can assign a role for.
- Which roles exist in the service.
- Which roles are required for particular actions.
About access management
In Yandex Cloud, all transactions are checked in Yandex Identity and Access Management. If a subject does not have the required permission, the service returns an error.
To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Yandex Cloud.
Roles for a resource can be assigned by users who have the connection-manager.admin
or one of the following roles for that resource:
admin
resource-manager.admin
organization-manager.admin
resource-manager.clouds.owner
organization-manager.organizations.owner
Which resources you can assign a role for
You can assign a role for an organization, cloud, folder, or connection. The roles assigned for organizations, clouds, or folders also apply to nested resources.
You can assign a role for a connection in the management console.
Roles existing in Connection Manager
You can use Yandex MetaData Hub roles (service roles) and Yandex Cloud roles (primitive roles) to manage connection access permissions.
Service roles for managing connections using Yandex Connection Manager
With Yandex Connection Manager service roles, you can view non-secret connection data and manage connections. You can view secret connection data, such as DB passwords, in Yandex Lockbox. To do this, you will also need the lockbox.payloadViewer
role.
connection-manager.auditor
The connection-manager.auditor
role allows you to view public details on connections and access bindings to them. If you have this role assigned for a cloud, it will also enable viewing Connection Manager quotas.
connection-manager.viewer
The connection-manager.viewer
role enables viewing info on connections and access bindings to them, as well as on the Connection Manager quotas.
This role also includes the connection-manager.auditor
permissions.
connection-manager.editor
The connection-manager.editor
role allows you to manage connections and view their details.
Users with this role can:
- Create, use, edit, and delete connections.
- View connection details and info on connection access bindings.
- View info on Connection Manager quotas.
This role also includes the connection-manager.viewer
permissions.
connection-manager.admin
The connection-manager.admin
role allows you to manage connections and access to those, as well as view connection details.
Users with this role can:
- Create, use, edit, and delete connections, as well as manage access to them.
- View connection details and info on connection access bindings.
- View info on Connection Manager quotas.
This role also includes the connection-manager.editor
permissions.
Primitive roles
auditor
Grants permission to view service configuration and metadata without access to data.
viewer
Enables you to view information about resources.
editor
Allows managing (creating, editing, and deleting) resources.
admin
Allows you to manage your resources and access to them.
For more information about primitive roles, see the Yandex Cloud role reference.
What roles do I need
The table below lists the roles needed to perform a particular action. You can always assign a role granting more permissions than the role specified. For example, you can assign the editor
role instead of viewer
.
Action | Required roles |
---|---|
Getting information about connections | connection-manager.viewer |
Getting a list of connections | connection-manager.viewer |
Creating a connection | connection-manager.editor |
Editing a connection | connection-manager.editor |
Deleting a connection | connection-manager.editor |
Setting connection access permissions | connection-manager.admin |
Changing connection access permissions | connection-manager.admin |