Access management in WebSQL

In this section, you will learn:

• Which resources you can assign a role for.
• Which roles exist in the service.
• Which roles are required for particular actions.

About access managementAbout access management

In Yandex Cloud, all transactions are checked in Yandex Identity and Access Management. If a subject does not have the required permission, the service returns an error.

To grant permissions for a resource, assign roles for this resource to the subject that will perform the operations. You can assign roles to a Yandex account, service account, federated users, user group, system group, or public group. For more information, see How access management works in Yandex Cloud.

Roles for a resource can be assigned by users who have the websql.admin role or one of the following roles for that resource:

• admin
• resource-manager.admin
• organization-manager.admin
• resource-manager.clouds.owner
• organization-manager.organizations.owner

Which resources you can assign a role forWhich resources you can assign a role for

You can assign a role to an organization, cloud, or folder. The roles assigned for organizations, clouds, or folders also apply to nested resources.

You can also assign roles in the WebSQL interface for saved and historical queries you published.

Which roles exist in the serviceWhich roles exist in the service

You can use Yandex WebSQL roles (service roles) and Yandex Cloud roles (primitive roles) to manage query access permissions.

Service rolesService roles

The list below shows all roles considered when verifying access permissions in WebSQL.

websql.executedQueries.auditorwebsql.executedQueries.auditor

The websql.executedQueries.auditor role enables viewing the metadata of a published query from the history as well as information on access permissions assigned to it.

websql.savedQueries.auditorwebsql.savedQueries.auditor

The websql.savedQueries.auditor role enables viewing the metadata of a published saved query as well as information on access permissions assigned to it.

websql.executedQueries.viewerwebsql.executedQueries.viewer

The websql.executedQueries.viewer role enables viewing info on a published query from the history and access permissions assigned to it.

This role also includes the websql.executedQueries.auditor permissions.

The role is assigned for a published historical query.

websql.savedQueries.viewerwebsql.savedQueries.viewer

The websql.savedQueries.viewer role enables viewing info on a published saved query and access permissions assigned to it.

This role also includes the websql.savedQueries.auditor permissions.

The role is assigned for a saved query you published.

websql.executedQueries.editorwebsql.executedQueries.editor

The websql.executedQueries.editor role enables viewing info on a published query from the history and delete such a query.

Users with this role can:

• View info on a published query from the history and delete such a query.
• View info on the access permissions assigned to a published query from the history.

This role also includes the websql.executedQueries.viewer permissions.

The role is assigned for a published historical query.

websql.savedQueries.editorwebsql.savedQueries.editor

The websql.savedQueries.editor role enables modifying and deleting a published saved query.

Users with this role can:

• View info on a published saved query, as well as modify and delete it.
• View info on the access permissions assigned to a published saved query.

This role also includes the websql.savedQueries.viewer permissions.

The role is assigned for a saved query you published.

websql.executedQueries.adminwebsql.executedQueries.admin

The websql.executedQueries.admin role enables managing a published query from the history and access to such a query.

Users with this role can:

• View info on the access permissions assigned to a published query from the history and modify such permissions.
• View info on a published query from the history and delete such a query.

This role also includes the websql.executedQueries.editor permissions.

The role is assigned for a published historical query.

websql.savedQueries.adminwebsql.savedQueries.admin

The websql.savedQueries.admin role enables managing a published saved query and access to it.

Users with this role can:

• View info on the access permissions assigned to a published saved query and modify such permissions.
• View info on a published saved query, as well as modify and delete it.

This role also includes the websql.savedQueries.editor permissions.

The role is assigned for a saved query you published.

websql.auditorwebsql.auditor

The websql.auditor role enables viewing the metadata of all published queries within WebSQL as well as information on access permissions assigned to them.

This role also includes the websql.savedQueries.auditor and websql.executedQueries.auditor permissions.

websql.viewerwebsql.viewer

The websql.viewer role enables viewing info on all published queries within WebSQL and access permissions assigned to them.

Users with this role can:

• View info on the published saved queries and access permissions assigned to them.
• View info on the published queries from the history and access permissions assigned to them.

This role also includes the websql.savedQueries.viewer and websql.executedQueries.viewer permissions.

websql.userwebsql.user

The websql.user role enables viewing info on the published queries within WebSQL, as well as create, modify, and delete such queries.

Users with this role can:

• View info on the published saved queries and access permissions assigned to them.
• Privately save queries and modify and delete privately saved queries.
• View info on the published queries from the history and access permissions assigned to them.
• Save the run queries to private history and delete them from history.

This role also includes the websql.viewer permissions.

websql.editorwebsql.editor

The websql.editor role enables managing published and private queries within WebSQL.

Users with this role can:

• View info on the published saved queries and access permissions assigned to them, as well as modify and delete such queries.
• Save queries privately, as well as modify, delete, and publish private saved queries.
• View info on the published queries from the history and access permissions assigned to them, as well as modify and delete such queries.
• Save the run queries to private history, as well publish private queries from the history and delete them.

This role also includes the websql.user, websql.savedQueries.editor, and websql.executedQueries.editor permissions.

websql.adminwebsql.admin

The websql.admin role enables managing private queries and publishing them, as well as manage published queries and access to those.

Users with this role can:

• View info on the access permissions assigned to the published saved queries and modify such permissions.
• View info on the published saved queries, as well as modify and delete them.
• Save queries privately, as well as modify, delete, and publish private saved queries.
• View info on the access permissions assigned to the published queries from the history and modify such permissions.
• View info on the published queries from the history and delete them.
• Save the run queries to private history, as well publish private queries from the history and delete them.

This role also includes the websql.editor, websql.savedQueries.admin, and websql.executedQueries.admin permissions.

Primitive rolesPrimitive roles

Primitive roles allow users to perform actions in all Yandex Cloud services.

auditorauditor

The auditor role grants a permission to read configuration and metadata of any Yandex Cloud resources without any access to data.

For instance, users with this role can:

• View info on a resource.
• View the resource metadata.
• View the list of operations with a resource.

auditor is the most secure role that does not grant any access to the service data. This role suits the users who need minimum access to the Yandex Cloud resources.

viewerviewer

The viewer role grants the permissions to read the info on any Yandex Cloud resources.

This role also includes the auditor permissions.

Unlike auditor, the viewer role provides access to service data in read mode.

editoreditor

The editor role provides permissions to manage any Yandex Cloud resources, except for assigning roles to other users, transferring organization ownership, removing an organization, and deleting Key Management Service encryption keys.

For instance, users with this role can create, modify, and delete resources.

This role also includes the viewer permissions.

adminadmin

The admin role enables assigning any roles, except for resource-manager.clouds.owner and organization-manager.organizations.owner, and provides permissions to manage any Yandex Cloud resources (except for transferring organization ownership and removing an organization).

Prior to assigning the admin role for an organization, cloud, or billing account, make sure to check out the information on protecting privileged accounts.

This role also includes the editor permissions.

Instead of primitive roles, we recommend using service roles. This ensures more selective access control and implementation of the principle of least privilege.

For more information about primitive roles, see the Yandex Cloud role reference.

What roles do I needWhat roles do I need

The table below lists the roles required to perform a particular action. You can always assign a role offering more permissions than the one specified. For example, you can assign the editor role instead of viewer. If you need access to multiple types of managed DB clusters within one folder, you can assign the mdb.auditor role for this folder, but bear in mind that the user will thus get excessive permissions.

Action	Required roles
Viewing queries
Viewing information on connections	connection-manager.viewer for an organization, cloud, folder, or connection
Viewing information on PostgreSQL connections	managed-postgresql.viewer for an organization, cloud, or folder
Viewing information on MySQL® connections	managed-mysql.viewer for an organization, cloud, or folder
Viewing information on ClickHouse® connections	managed-clickhouse.viewer for an organization, cloud, or folder
Viewing information on Valkey™ connections	managed-redis.viewer for an organization, cloud, or folder
Viewing metadata of published queries	websql.auditor for an organization, cloud, or folder
Viewing published queries	websql.viewer for an organization, cloud, or folder
Viewing and running queries
Using a database connection	connection-manager.user for an organization, cloud, folder, or connection
Viewing information on PostgreSQL connections	managed-postgresql.viewer for an organization, cloud, or folder
Viewing information on MySQL® connections	managed-mysql.viewer for an organization, cloud, or folder
Viewing information on ClickHouse® connections	managed-clickhouse.viewer for an organization, cloud, or folder
Viewing information on Valkey™ connections	managed-redis.viewer for an organization, cloud, or folder
Making queries	websql.user for an organization, cloud, or folder
Viewing, running, and publishing queries
Using a database connection	connection-manager.user for an organization, cloud, folder, or connection
Viewing information on PostgreSQL connections	managed-postgresql.viewer for an organization, cloud, or folder
Viewing information on MySQL® connections	managed-mysql.viewer for an organization, cloud, or folder
Viewing information on ClickHouse® connections	managed-clickhouse.viewer for an organization, cloud, or folder
Viewing information on Valkey™ connections	managed-redis.viewer for an organization, cloud, or folder
Running, publishing, and editing queries	websql.editor for an organization, cloud, or folder
Managing queries
Using a database connection	connection-manager.user for an organization, cloud, folder, or connection
Viewing information on PostgreSQL connections	managed-postgresql.viewer for an organization, cloud, or folder
Viewing information on MySQL® connections	managed-mysql.viewer for an organization, cloud, or folder
Viewing information on ClickHouse® connections	managed-clickhouse.viewer for an organization, cloud, or folder
Viewing information on Valkey™ connections	managed-redis.viewer for an organization, cloud, or folder
Running, publishing, and editing queries and managing access permissions to them	websql.admin for an organization, cloud, or folder

What's nextWhat's next

• How to assign a role.
• How to revoke a role.
• Learn more about access management in Yandex Cloud.
• Learn more about inheriting roles.