Access management in Yandex Cloud Organization

1. Select the role you want to assign. You can find the description of the roles in the Yandex Identity and Access Management documentation in the Yandex Cloud role reference.

2. Get the user ID.

3. Assign the role using this command:

   yc <service_name> <resource> add-access-binding <resource_name_or_ID> \
       --role <role_ID> \
       --subject <subject_type>:<subject_ID>
   

   • <service_name>: Name of the service for whose resource you are assigning the role, e.g., organization-manager.
   • <resource>: Resource category. For an organization, it is always organization.
   • <resource_name_or_ID>: Resource name or ID. For an organization, use its technical name.
   • --role: Role ID, e.g., organization-manager.admin.
   • --subject: Type and ID of the subject you are assigning the role to.

   For example, this command assigns the administrator role for the organization with the bpf3crucp1v2******** ID:

   yc organization-manager organization add-access-binding bpf3crucp1v2******** \
       --role organization-manager.admin \
       --subject userAccount:aje6o61dvog2********
   

If you do not have Terraform yet, install it and configure its Yandex Cloud provider.

1. Describe the parameters of the roles you assign in the configuration file:

   • organization_id: Organization ID.
   • role: Role you want to assign. You can find the description of the roles in the Yandex Identity and Access Management documentation in the Yandex Cloud role reference. For each role, you can only use one yandex_organization manager_organization_iam_binding resource.
   • members: Array of the IDs of users to assign the role to:
     • userAccount:{user_id}: User Yandex account ID.
     • serviceAccount:{service_account_id}: Service account ID.
     • federatedUser:{federated_user_id}: Federated user ID.

   Here is the configuration file example:

   resource "yandex_organizationmanager_organization_iam_binding" "editor" {
     organization_id = "<organization_ID>"
     role = "editor"
     members = [
      "federatedUser:<user_ID>",
     ]
   }
   

   For more information about the resources you can create with Terraform, see the relevant provider documentation.

2. Make sure the configuration files are correct.

   1. In the command line, go to the directory where you created the configuration file.
   2. Run a check using this command:

   terraform plan
   

   If the configuration is described correctly, the terminal will display a list of the assigned roles. If the configuration contains any errors, Terraform will point them out.

3. Assign roles.

   If the configuration does not contain any errors, run this command:

   terraform apply
   

   This assigns the roles in the specified organization.

Use the updateAccessBindings method for the appropriate resource.

1. Select the role you want to assign. You can find the description of the roles in the Yandex Identity and Access Management documentation in the Yandex Cloud role reference.

2. Get the user ID.

3. Create the request body, e.g., in the body.json file. In the action property, enter ADD and specify the userAccount type and user ID under subject.

   Example of the body.json file:

   {
     "accessBindingDeltas": [{
       "action": "ADD",
       "accessBinding": {
         "roleId": "organization-manager.admin",
         "subject": {
           "id": "gfei8n54hmfh********",
           "type": "userAccount"
         }
       }
     }]
   }
   

4. Assign the role. For example, for an organization with the bpf3crucp1v2******** ID:

   export ORGANIZATION_ID=bpf3crucp1v2********
   export IAM_TOKEN=CggaAT********
   curl \
     --request POST \
     --header "Content-Type: application/json" \
     --header "Authorization: Bearer ${IAM_TOKEN}" \
     --data '@body.json' \
     "https://organization-manager.api.cloud.yandex.net/organization-manager/v1/organizations/${ORGANIZATION_ID}:updateAccessBindings"
   

   For detailed instructions on assigning a role to a resource, please see the Yandex Identity and Access Management and Yandex Resource Manager documentation:

   • Setting up service account access permissions
   • Setting up cloud access permissions
   • Setting up folder access permissions

To revoke a role from a subject, delete access permissions for the appropriate resource:

1. View the roles and assignees for the resource:

   yc <service_name> <resource> list-access-bindings <resource_name_or_ID>
   

   • <service_name>: Name of the service the resource belongs to, e.g., organization-manager.
   • <resource>: Resource category. For an organization, it is always organization.
   • <resource_name_or_ID>: Resource name or ID. For an organization, use its technical name.

   For example, view the roles and assignees in an organization with the bpf3crucp1v2******** ID:

   yc organization-manager organization list-access-bindings bpf3crucp1v2********
   

   Result:

   +------------------------------------------+--------------+----------------------+
   |                 ROLE ID                  | SUBJECT TYPE |      SUBJECT ID      |
   +------------------------------------------+--------------+----------------------+
   | organization-manager.organizations.owner | userAccount  | aje3r40rsemj******** |
   | organization-manager.admin               | userAccount  | aje6o61dvog2******** |
   +------------------------------------------+--------------+----------------------+
   

2. To delete access permissions, run this command:

   yc <service_name> <resource> remove-access-binding <resource_name_or_ID> \
       --role <role_ID> \
       --subject <subject_type>:<subject_ID>
   

   • --role: ID of the role to revoke, e.g., organization-manager.admin.
   • --subject: Type and ID of the subject to revoke the role from.

   For example, to revoke a role from a user with the aje6o61dvog2******** ID:

   yc organization-manager organization remove-access-binding bpf3crucp1v2******** \
       --role organization-manager.admin \
       --subject userAccount:aje6o61dvog2********
   

To revoke a role from a subject, delete access permissions for the appropriate resource:

1. View the roles and assignees for the resource using the listAccessBindings method. For example, to view the roles in the organization with the bpf3crucp1v2******** ID:

   export ORGANIZATION_ID=bpf3crucp1v2********
   export IAM_TOKEN=CggaAT********
   curl \
     --header "Authorization: Bearer ${IAM_TOKEN}" \
     "https://organization-manager.api.cloud.yandex.net/organization-manager/v1/organizations/${ORGANIZATION_ID}:listAccessBindings"
   

   Result:

   {
   "accessBindings": [
   {
     "subject": {
     "id": "aje6o61dvog2********",
     "type": "userAccount"
     },
     "roleId": "organization-manager.admin"
   }
   ]
   }
   

2. Create the request body, e.g., in the body.json file. In the request body, specify the access permissions to delete. For example, revoke the organization-manager.admin role from the aje6o61dvog2******** user:

   Example of the body.json file:

   {
     "accessBindingDeltas": [{
       "action": "REMOVE",
       "accessBinding": {
         "roleId": "organization-manager.admin",
         "subject": {
           "id": "aje6o61dvog2********",
           "type": "userAccount"
         }
       }
     }]
   }
   

3. Revoke a role by deleting the specified permissions:

   export ORGANIZATION_ID=bpf3crucp1v2********
   export IAM_TOKEN=CggaAT********
   curl \
     --request POST \
     --header "Content-Type: application/json" \
     --header "Authorization: Bearer ${IAM_TOKEN}" \
     --data '@body.json' \
     "https://organization-manager.api.cloud.yandex.net/organization-manager/v1/organizations/${ORGANIZATION_ID}:updateAccessBindings"
   

If you do not have the Yandex Cloud CLI yet, install and initialize it.

1. Select a role from the Yandex Cloud role reference.

2. Assign the role using this command:

   yc <service_name> <resource> add-access-binding <resource_name_or_ID> \
     --role <role_ID> \
     --subject group:<group_ID>
   

   Where:

   • --role: Role ID, e.g., resource-manager.clouds.owner.

   • --subject group: ID of the group the role is assigned to.

     To assign a role to one of the system groups, instead of --subject, use the --organization-users <organization_ID> or --federation-users <federation_ID> parameter. In the parameter, provide the ID of the organization or identity federation, respectively, to all the users you want to assign the role to.

     You can also assign a role to a system group using the --subject parameter. To do this, provide in it the subject ID matching the selected system group.

   For example, assign the resource-manager.viewer role for the my-cloud cloud:

   yc resource-manager cloud add-access-binding mycloud \
     --role resource-manager.viewer \
     --subject group:aje6o61dvog2********
   

If you do not have Terraform yet, install it and configure its Yandex Cloud provider.

1. Add the resource parameters to the configuration file and specify the required role and group:

   resource "yandex_resourcemanager_cloud_iam_member" "admin" {
     cloud_id    = "<cloud_ID>"
     role        = "<role_ID>"
     member      = "group:<group_ID>"
   }
   

   Where:

   • cloud_id: Cloud ID. You can also assign a role within an individual folder. To do this, specify folder_id instead of cloud_id and the required folder ID in the resource parameters.

   • role: Role to assign. This is a required parameter.

   • member: Group the role is assigned to. Use this format: group:<group_ID>. This is a required parameter.

     To assign a role to one of the system groups, specify the following in the member parameter:

     • system:group:organization:<organization_ID>:users: To assign a role to the All users in organization X system group.
     • system:group:federation:<federation_ID>:users: To assign a role to the All users in federation N system group.

   For more information about the yandex_resourcemanager_cloud_iam_member resource parameters, see this Terraform article.

2. Create the resources:

   1. In the terminal, change to the folder where you edited the configuration file.

   2. Make sure the configuration file is correct using the command:

      terraform validate
      

      If the configuration is correct, the following message is returned:

      Success! The configuration is valid.
      

   3. Run the command:

      terraform plan
      

      The terminal will display a list of resources with parameters. No changes are made at this step. If the configuration contains errors, Terraform will point them out.

   4. Apply the configuration changes:

      terraform apply
      

   5. Confirm the changes: type yes in the terminal and press Enter.

   This will create all the resources you need in the specified folder. You can check the new resource using the management console or this CLI command:

   terraform plan
   

   If the configuration is correct, the terminal will display a list of the resources being created and their parameters. If the configuration contains any errors, Terraform will point them out.

3. Deploy the cloud resources.

   1. If the configuration does not contain any errors, run this command:

      terraform apply
      

   2. Confirm creating the resources: type yes in the terminal and press Enter.

   This will create all the resources you need in the specified folder. You can check the new resource using the management console or this CLI command:

   yc resource-manager folder list-access-bindings <folder_name_or_ID>
   

Use the updateAccessBindings REST API method for the appropriate resource.

1. Select a role from the Yandex Cloud role reference.

2. Create the request body, e.g., in the body.json file. In the action property, enter ADD, and specify the group type and group ID under subject:

   body.json:

   {
     "accessBindingDeltas": [{
       "action": "ADD",
       "accessBinding": {
         "roleId": "editor",
         "subject": {
           "id": "<group_ID>",
           "type": "group"
         }
       }
     }]
   }
   

3. Assign a role to a service account. For example, for a folder with the b1gvmob95yys******** ID:

   export FOLDER_ID=b1gvmob95yys********
   export IAM_TOKEN=CggaAT********
   curl \
     --request POST \
     --header "Content-Type: application/json" \
     --header "Authorization: Bearer ${IAM_TOKEN}" \
     --data '@body.json' \
     "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:updateAccessBindings"
   

To learn how to assign a role for the respective resource, see:

• Setting up service account access permissions.
• Setting up cloud access permissions.
• Setting up folder access permissions.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

1. Assign the role to the group:

   yc organization-manager organization add-access-binding \
     --subject group:<group_ID> \
     --role <role_ID> \
     --organization-users <organization_ID> \
     --federation-users <federation_ID>
   

   To assign a role to one of the system groups, instead of the --subject parameter, use --organization-users <organization_ID> or --federation-users <federation_ID>. In the parameter, provide the ID of the organization or identity federation, respectively, to all the users you want to assign the role to.

   You can also assign a role to a system group using the --subject parameter. To do this, provide in it the subject ID matching the selected system group.

2. Make sure the requested permissions are granted:

   yc organization-manager organization list-access-bindings <organization_ID>
   

   A response contains a list of all roles assigned to users and groups in the organization:

   +------------------------------------------+--------------+----------------------+
   |                 ROLE ID                  | SUBJECT TYPE |      SUBJECT ID      |
   +------------------------------------------+--------------+----------------------+
   | organization-manager.admin               | userAccount  | ajev1p2345lj******** |
   | organization-manager.organizations.owner | userAccount  | ajev1p2345lj******** |
   | editor                                   | group        | ajev1p2345lj******** |
   | viewer                                   | group        | ajev1p2345lj******** |
   +------------------------------------------+--------------+----------------------+
   

If you do not have Terraform yet, install it and configure its Yandex Cloud provider.

1. Add the resource parameters to the configuration file and specify the required role and group:

   resource "yandex_organizationmanager_organization_iam_member" "users-editors" {
     organization_id = "<organization_ID>"
     role            = "<role_ID>"
     member          = "group:<group_ID>"
   }
   

   Where:

   • organization_id: Organization ID. This is a required parameter.

   • role: Role to assign. This is a required parameter.

   • member: Group the role is assigned to. Use this format: group:<group_ID>. This is a required parameter.

     To assign a role to one of the system groups, specify the following in the member parameter:

     • system:group:organization:<organization_ID>:users: To assign a role to the All users in organization X system group.
     • system:group:federation:<federation_ID>:users: To assign a role to the All users in federation N system group.

   For more information about the yandex_organizationmanager_organization_iam_member resource parameters, see this Terraform article.

2. Create the resources:

   1. In the terminal, change to the folder where you edited the configuration file.

   2. Make sure the configuration file is correct using the command:

      terraform validate
      

      If the configuration is correct, the following message is returned:

      Success! The configuration is valid.
      

   3. Run the command:

      terraform plan
      

      The terminal will display a list of resources with parameters. No changes are made at this step. If the configuration contains errors, Terraform will point them out.

   4. Apply the configuration changes:

      terraform apply
      

   5. Confirm the changes: type yes in the terminal and press Enter.

   This will create all the resources you need in the specified folder. You can check the new resource using the management console or this CLI command:

   yc resource-manager folder list-access-bindings <folder_name_or_ID>