Configuring VM placement group access permissions

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

1. See the description of the CLI command for assigning a role for a VM placement group:

   yc compute placement-group add-access-binding --help
   

2. Get a list of VM placement groups in the default folder:

   yc compute placement-group list
   

3. View the roles already assigned for the resource:

   yc compute placement-group list-access-bindings <placement_group_ID>
   

4. Assign a role using this command:

   yc compute placement-group add-access-binding <placement_group_ID> \
     --role <role> \
     --subject <subject_type>:<subject_ID>
   

   Where:

   • --role: Role.

   • --subject: Subject getting the role.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and matching CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the guides on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

To assign a role for access to a VM placement group using Terraform:

1. In the Terraform configuration file, describe the resources you want to create:

   resource "yandex_compute_placement_group_iam_binding" "sa-access" {
     placement_group_id = "<placement_group_ID>"
     role               = "<role>"
     members            = ["<subject_type>:<subject_ID>"]
   }
   

   Where:

   • placement_group_id: VM placement group ID.

   • role: Role.

   • members: List of designations of subjects the role is assigned to.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. Here is how you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more information about the properties of the yandex_compute_placement_group_iam_binding resource, see this provider guide.

2. Apply the changes:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   Terraform will create all the required resources. You can check the updates using the management console or this CLI command:

   yc compute placement-group list-access-bindings <placement_group_ID>
   

To assign a role, use the updateAccessBindings REST API method for the PlacementGroup resource or the PlacementGroupService/UpdateAccessBindings gRPC API call. In the request body, set the action property to ADD and specify the subject type and ID under subject.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

You can assign multiple roles using the set-access-bindings command.

1. Make sure the resource has no roles assigned that you would not want to lose:

   yc compute placement-group list-access-bindings <placement_group_ID>
   

2. See the description of the CLI command for assigning roles for a VM placement group:

   yc compute placement-group set-access-bindings --help
   

3. Assign the roles:

   yc compute placement-group set-access-bindings <placement_group_ID> \
     --access-binding role=<role>,subject=<subject_type>:<subject_ID> \
     --access-binding role=<role>,subject=<subject_type>:<subject_ID>
   

   Where --access-binding contains access permission settings:

   • role: Role.

   • subject: Subject getting the role.

     Indicating a subject

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and matching CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

   For example, assign roles to several users and one service account:

   yc compute placement-group set-access-bindings my-group \
     --access-binding role=editor,subject=userAccount:gfei8n54hmfh******** \
     --access-binding role=viewer,subject=userAccount:helj89sfj80a******** \
     --access-binding role=editor,subject=serviceAccount:ajel6l0jcb9s********
   

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the guides on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

To assign multiple roles for a VM placement group using Terraform:

1. In the Terraform configuration file, describe the resources you want to create:

   resource "yandex_compute_placement_group_iam_binding" "role1" {
     placement_group_id = "<placement_group_ID>"
     role               = "<role_1>"
     members            = ["<subject_type>:<subject_ID>"]
   }
   
   resource "yandex_compute_placement_group_iam_binding" "role2" {
     placement_group_id = "<placement_group_ID>"
     role               = "<role_2>"
     members            = ["<subject_type>:<subject_ID>"]
   }
   

   Where:

   • placement_group_id: VM placement group ID.

   • role: Role.

   • members: List of designations of subjects the role is assigned to.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. Here is how you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more information about the properties of the yandex_compute_placement_group_iam_binding resource, see this provider guide.

2. Apply the changes:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   Terraform will create all the required resources. You can check the updates using the management console or this CLI command:

   yc compute placement-group list-access-bindings <placement_group_ID>
   

To assign roles for a placement group, use the setAccessBindings REST API method for the PlacementGroup resource or the PlacementGroupService/SetAccessBindings gRPC API call. In the request body, specify the subject type and ID under subject.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

1. See the description of the CLI command for revoking a role for a placement group:

   yc compute placement-group remove-access-binding --help
   

2. View the list of users and their roles for the resource:

   yc compute placement-group list-access-bindings <placement_group_ID>
   

3. To revoke access permissions, run this command:

   yc compute placement-group remove-access-binding <placement_group_ID> \
     --role=<role> \
     --subject=<subject_type>:<subject_ID>
   

   Where:

   • --role: ID of the role you need to revoke.

   • --subject: Designation of the subject you want to revoke the role from.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and matching CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

   For example, this command revokes the viewer role for the placement group from a user with the ajel6l0jcb9s******** ID:

   yc compute placement-group remove-access-binding my-group \
     --role viewer \
     --subject userAccount:ajel6l0jcb9s********
   

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the guides on the Terraform website or its mirror.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

To revoke a role assigned for a VM placement group using Terraform:

1. Open the Terraform configuration file and delete the fragment describing the role:

   resource "yandex_compute_placement_group_iam_binding" "sa-access" {
     placement_group_id = "<placement_group_ID>"
     role               = "<role>"
     members            = ["<subject_type>:<subject_ID>"]
   }
   

2. Apply the changes:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   You can check the updates using the management console or this CLI command:

   yc compute placement-group list-access-bindings <placement_group_ID>
   

To revoke a role, use the updateAccessBindings REST API method for the PlacementGroup resource or the PlacementGroupService/UpdateAccessBindings gRPC API call. In the request body, set the action property to REMOVE and specify the subject type and ID under subject.