Authenticating in the Yandex Cloud CLI with an IAM token from an environment variable

An IAM token is a unique sequence of characters used for authentication in Yandex Cloud that verifies the identity of a user or service account. IAM tokens are valid for a maximum of 12 hours.

Authentication with an IAM token from the YC_IAM_TOKEN environment variable is a convenient option for scripts, CI/CD workflows, automated tests, containers, and temporary runtime environments where it is impractical to use interactive authentication or store credentials in the CLI profile. For automation, use the IAM token of a service account that has the required roles. Configure a mechanism to issue a new IAM token before the current token expires.

Getting startedGetting started

1. Install the Yandex Cloud CLI.

2. Get an IAM token.

   • Yandex account
   • Service account
   • Federated account
   • Local user account

Authenticate with an IAM tokenAuthenticate with an IAM token

1. Add your IAM token to the YC_IAM_TOKEN environment variable:

   macOS/Linux

   Windows (PowerShell)

   export YC_IAM_TOKEN="<IAM_token>"
   

   $env:YC_IAM_TOKEN = "<IAM_token>"
   

   The variable will be available in the current shell session and its child processes.

   Warning

   The value from the YC_IAM_TOKEN environment variable overrides the authentication credentials specified in the CLI profile.

2. Run a CLI command, e.g., to get a list of VMs within a folder:

   yc compute instance list
   

Delete the IAM token from the environment variableDelete the IAM token from the environment variable

To enable the CLI to use the profile credentials again, delete the YC_IAM_TOKEN environment variable:

unset YC_IAM_TOKEN

Remove-Item Env:YC_IAM_TOKEN

Useful linksUseful links

• IAM token

• Getting an IAM token for a Yandex account

• Getting an IAM token for a service account

• Getting an IAM token for a federated account

• Getting an IAM token for a local user account

• Revoking an IAM token

• Authentication in the Yandex Cloud CLI with a Yandex account

• Authenticating in the Yandex Cloud CLI as a service account

• Authenticating with the Yandex Cloud CLI as a federated user

• Authenticating in the Yandex Cloud CLI as a local user

• Authenticating with the Yandex Cloud CLI on a server with no GUI

• Yandex Cloud CLI troubleshooting