Revoking roles assigned for a trail

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameters.

1. See the description of the CLI command to revoke roles assigned for a trail:

   yc audit-trails trail remove-access-binding --help
   

2. Get a list of trails:

   yc audit-trails trail list
   

   Result:

   +----------------------+--------------+--------+-------------------+
   |          ID          |     NAME     | STATUS |      FILTERS      |
   +----------------------+--------------+--------+-------------------+
   | cnp82sb0phnm******** | trailfromapi | ACTIVE | storage compute   |
   |                      |              |        | management.events |
   | cnp8v52idttr******** | tf-trail     | ACTIVE | storage compute   |
   |                      |              |        | mdb.postgresql    |
   | cnpnkcubr529******** | test-2       | ACTIVE | compute           |
   +----------------------+--------------+--------+-------------------+
   

3. To revoke a role assigned for a trail, run this command:

   • From a user:

     yc audit-trails trail remove-access-binding \
       --id <trail_ID> \
       --user-account-id <user_ID> \
       --role <role>
     

     Result:

     done (1s)
     

   • From a service account:

     yc audit-trails trail remove-access-binding \
       --id <trail_ID> \
       --service-account-id <service_account_ID> \
       --role <role>
     

     Result:

     done (1s)
     

   • From all authorized users (the All authenticated users public group):

     yc audit-trails trail remove-access-binding \
       --id <trail_ID> \
       --all-authenticated-users \
       --role <role>
     

     Result:

     done (1s)