Revoking a registry role

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also set a different folder for any specific command using the --folder-name or --folder-id options.

1. View assigned roles:

   yc cloud-registry registry list-access-bindings <registry_name_or_ID>
   

2. Revoke a role:

   • From a user:

     yc cloud-registry registry remove-access-binding <registry_name_or_ID> \
       --role <role> \
       --user-account-id <user_ID>
     

   • From a service account:

     yc cloud-registry registry remove-access-binding <registry_name_or_ID> \
       --role <role> \
       --service-account-id <service_account_ID>
     

   • From all authenticated users (the All authenticated users public group):

     yc cloud-registry registry remove-access-binding <registry_name_or_ID> \
       --role <role> \
       --allAuthenticatedUsers
     

   • From all users (All users public group):

     yc cloud-registry registry remove-access-binding <registry_name_or_ID> \
       --role <role> \
       --allUsers
     

     Where <role> is the role you want to revoke.

To revoke all registry roles and assign new ones right away, use the yc cloud-registry registry set-access-bindings command.

Example

The example below revokes the cloud-registry.admin role for my-first-registry from a user.

yc cloud-registry registry remove-access-binding my-first-registry \
  --role cloud-registry.admin \
  --user-account-id ajeugsk5ubk6********

Result:

done (9s)

View the roles assigned for the registry.

To revoke registry roles, use the updateAccessBindings REST API method for the Registry resource or the RegistryService/UpdateAccessBindings gRPC API call.