Access management in Compute Cloud

In this section, you will learn about:

• About access management in Yandex Cloud.
• Resources you can assign a role for.
• Roles this service has.
• What roles are required to perform specific actions.

Access managementAccess management

Yandex Identity and Access Management checks all operations in Yandex Cloud. If an entity does not have required permissions, IAM returns an error.

To grant permissions for a resource, assign the relevant resource roles to an entity performing operations. You can assign roles to a Yandex account, service account, local user, federated user, user group, system group, or public group. For more information, see How access management works in Yandex Cloud.

To assign a role for a resource, a user should have the compute.admin role or one of the following roles for that resource:

• admin
• resource-manager.admin
• organization-manager.admin
• resource-manager.clouds.owner
• organization-manager.organizations.owner

Which resources you can assign a role forWhich resources you can assign a role for

You can assign a role to an organization, cloud, or folder. The roles assigned to organizations, clouds, and folders also apply to their nested resources.

You can also assign roles for individual resources of the service:

Roles this service hasRoles this service has

The chart below shows service’s roles and their permission inheritance. For example, editor inherits all viewer permissions. You can find role descriptions below the chart.

Service rolesService roles

compute.auditorcompute.auditor

The compute.auditor role allows you to view information on Compute Cloud resources and relevant operations, as well as on the amount of used resources and quotas. It does not allow you to access the serial port or serial console of an instance.

Users with this role can:

• View a list of instances and information on them.
• View a list of instance groups and information on them.
• View a list of instance placement groups and information on them.
• View lists of instances in placement groups.
• View a list of dedicated host groups and information on them.
• View lists of hosts and instances in dedicated host groups.
• View information on GPU clusters and instances included in these clusters.
• View a list of disks and information on them.
• View a list of file storages and information on them.
• View a list of non-replicated disk placement groups and information on them.
• View lists of disks in placement groups.
• View information on reserved instance pools.
• View a list of images and information on them.
• View information on image families, on images within families, on the latest family image, as well as on access permissions assigned to image families.
• View a list of disk snapshots and information on them.
• View information on disk snapshot schedules.
• View information on Compute Cloud resource and quota consumption and disk limits in the management console.
• View lists of resource operations for Compute Cloud, as well as information on these operations.
• View information on the status of configuring access via OS Login on instances.
• View information on available platforms.
• View a list of availability zones and information on them.

compute.viewercompute.viewer

The compute.viewer role allows you to view information on Compute Cloud resources and resource operations, as well as on access permissions assigned to the resources and on the amount of used resources and quotas. This role also grants access to instance metadata and serial port output.

Users with this role can:

• View the instance serial port output.
• View instance metadata.
• View a list of instances, information on instances and on access permissions assigned to them.
• View a list of instance groups and information on them.
• View a list of instance placement groups, information on instance placement groups and on access permissions assigned to them.
• View lists of instances in placement groups.
• View a list of dedicated host groups, information on dedicated host groups and on access permissions assigned to them.
• View lists of hosts and instances in dedicated host groups.
• View information on GPU clusters and instances included in GPU clusters, as well as the on access permissions assigned to these clusters.
• View a list of disks, information on disks and on access permissions assigned to them.
• View a list of file storages, information on file storages and on access permissions assigned to them.
• View a list of non-replicated disk placement groups, information on non-replicated disk placement groups and on access permissions assigned to them.
• View lists of disks in placement groups.
• View information on reserved instance pools.
• View a list of images, information on images and on access permissions assigned to them.
• View information on image families, on images within families, on the latest family image, as well as on access permissions assigned to image families.
• View a list of disk snapshots, information on disk snapshots and on access permissions assigned to them.
• View information on disk snapshot schedules and on access permissions assigned to them.
• View information on Compute Cloud resource and quota consumption and disk limits in the management console.
• View lists of resource operations for Compute Cloud, as well as information on these operations.
• View information on the status of configuring access via OS Login on instances.
• View information on available platforms.
• View a list of availability zones, information on availability zones and on access permissions assigned to them.

This role includes the compute.auditor and compute.snapshotSchedules.viewer permissions.

compute.editorcompute.editor

The compute.editor role allows you to manage instances, instance groups, disks, images, GPU clusters, and other Compute Cloud resources.

Users with this role can:

• Create, modify, start, restart, stop, move, and delete instances.
• View a list of instances, information on instances and on access permissions assigned to them.
• Connect and disconnect disks, file storages, and network interfaces to and from instances, as well as link security groups to instance network interfaces.
• Create instances with custom FQDNs and create multi-interface instances.
• Bind service accounts to instances and activate AWS v1 tokens on instances.
• Use the instance serial port for reading and writing.
• Simulate instance maintenance events.
• View instance metadata.
• View information on the status of configuring access via OS Login on instances and connect to instances via OS Login using SSH certificates or SSH keys.
• View a list of instance groups, information on instance groups and on access permissions assigned to them, as well as use, create, modify, start, stop, and delete instance groups.
• View a list of instance placement groups, information on instance placement groups and on access permissions assigned to them, as well as use, modify, and delete instance placement groups.
• View lists of instances in placement groups.
• View a list of dedicated host groups, information on dedicated host groups and on access permissions assigned to them, as well as use, modify, and delete dedicated host groups.
• View lists of hosts and instances in dedicated host groups.
• Modify scheduled maintenance windows for hosts in dedicated host groups.
• Use GPU clusters, as well as create, modify, and delete them.
• View information on GPU clusters and instances included in GPU clusters, as well as the on access permissions assigned to these clusters.
• View information on reserved instance pools, as well as create, use, modify, and delete them.
• View a list of disks, information on disks and on access permissions assigned to them, as well as use, modify, move, and delete disks.
• Create encrypted disks.
• View and update disk links.
• View a list of file storages, information on file storages and on access permissions assigned to them, as well as use, create, modify, and delete file storages.
• View a list of non-replicated disk placement groups, information on non-replicated disk placement groups and on access permissions assigned to them, as well as use, modify, and delete non-replicated disk placement groups.
• View lists of disks in placement groups.
• View a list of images, information on images and on access permissions assigned to them, as well as use, modify, and delete images.
• Create, modify, delete, and update image families.
• View information on image families, on images within families, on the latest family image, as well as on access permissions assigned to image families.
• View a list of disk snapshots, information on disk snapshots and on access permissions assigned to them, as well as use, modify, and delete disk snapshots.
• View information on disk snapshot schedules and on access permissions assigned to them, as well as create, modify, and delete disk snapshot schedules.
• View information on cloud networks and use them.
• View information on subnets and use them.
• View information on cloud resource addresses and use them.
• View information on route tables and use them.
• View information on security groups and use them.
• View information on NAT gateways and connect them to route tables.
• View information on the IP addresses used in subnets.
• View information on resource operations for Virtual Private Cloud.
• View information on Virtual Private Cloud quotas.
• View information on Compute Cloud resource and quota consumption and disk limits in the management console.
• View lists of resource operations for Compute Cloud and information on operations, as well as abort such operations.
• View information on available platforms and use them.
• View a list of availability zones, information on availability zones and on access permissions assigned to them.
• View information on the relevant cloud.
• View information on the relevant folder.

This role includes the compute.operator, compute.osLogin, compute.snapshotSchedules.editor, compute.disks.user, and vpc.user permissions.

compute.admincompute.admin

The compute.admin role allows you to manage instances, instance groups, disks, images, GPU clusters, and other Compute Cloud resources, as well as manage access to them.

Users with this role can:

• Create, modify, start, restart, stop, move, and delete instances, as well as manage access to them.
• View a list of instances, information on instances and on access permissions assigned to them.
• Connect and disconnect disks, file storages, and network interfaces to and from instances, as well as link security groups to instance network interfaces.
• Create instances with custom FQDNs and create multi-interface instances.
• Bind service accounts to instances and activate AWS v1 tokens on instances.
• Use the instance serial port for reading and writing.
• Simulate instance maintenance events.
• View instance metadata.
• View information on the status of configuring access via OS Login on instances and connect to instances via OS Login using SSH certificates or SSH keys and run commands as a superuser (sudo).
• Use, create, modify, start, stop, and delete instance groups, as well as manage access to instance groups.
• View a list of instance groups, information on instance groups and on access permissions assigned to them.
• Use, create, modify, and delete instance placement groups, as well as manage access to instance placement groups.
• View a list of instance placement groups, information on instance placement groups and on access permissions assigned to them.
• View lists of instances in placement groups.
• Use, create, modify, and delete dedicated host groups, as well as manage access to dedicated host groups.
• View a list of dedicated host groups, information on dedicated host groups and on access permissions assigned to them.
• View lists of hosts and instances in dedicated host groups.
• Modify scheduled maintenance windows for hosts in dedicated host groups.
• Use, create, modify, and delete GPU clusters, as well as manage access to them.
• View information on GPU clusters and instances included in GPU clusters, as well as the on access permissions assigned to these clusters.
• View information on reserved instance pools, as well as create, use, modify, and delete them.
• Use, create, modify, move, and delete disks, as well as manage access to them.
• Create encrypted disks.
• View a list of disks, information on disks and on access permissions assigned to them.
• View and update disk links.
• Use, create, modify, and delete file storages, as well as manage access to them.
• View a list of file storages, information on file storages and on access permissions assigned to them.
• Use, create, modify, and delete non-replicated disk placement groups, as well as manage access to non-replicated disk placement groups.
• View a list of non-replicated disk placement groups, information on non-replicated disk placement groups and on access permissions assigned to them.
• View lists of disks in placement groups.
• Use, create, modify, and delete images, as well as manage access to them.
• View a list of images, information on images and on access permissions assigned to them.
• Create, modify, delete, and update image families, as well as manage access to them.
• View information on image families, on images within families, on the latest family image, as well as on access permissions assigned to image families.
• Use, create, modify, and delete disk snapshots, as well as manage access to them.
• View a list of disk snapshots, information on disk snapshots and on access permissions assigned to them.
• Create, modify, and delete disk snapshot schedules, as well as manage access to them.
• View information on disk snapshot schedules and on access permissions assigned to them.
• View information on cloud networks and use them.
• View information on subnets and use them.
• View information on cloud resource addresses and use them.
• View information on route tables and use them.
• View information on security groups and use them.
• View information on NAT gateways and connect them to route tables.
• View information on the IP addresses used in subnets.
• View information on resource operations for Virtual Private Cloud.
• View information on Virtual Private Cloud quotas.
• View information on Compute Cloud resource and quota consumption and disk limits in the management console.
• View lists of resource operations for Compute Cloud and information on operations, as well as abort such operations.
• View information on available platforms and use them.
• View a list of availability zones, information on availability zones and on access permissions assigned to them.
• View information on the relevant cloud.
• View information on the relevant folder.

This role includes the compute.editor and compute.osAdminLogin permissions.

compute.osLogincompute.osLogin

The compute.osLogin role allows you to connect to instances via OS Login using SSH certificates or SSH keys.

compute.osAdminLogincompute.osAdminLogin

The compute.osAdminLogin role allows you to connect to instances using SSH certificates or SSH keys via OS Login and run commands as a superuser (sudo).

compute.disks.usercompute.disks.user

The compute.disks.user role allows you to view a list of disks and information on them, as well as use disks to create new resources, such as instances.

compute.images.usercompute.images.user

The compute.images.user role allows you to view a list of images and information on them, get information on the latest image within the image family, as well as use images to create new resources, such as instances.

compute.operatorcompute.operator

The compute.operator role allows you to start and stop instances and instance groups, as well as view information on Compute Cloud resources and resource operations, as well as on access permissions assigned to the resources and the amount of used resources and quotas.

Users with this role can:

• Start, restart, and stop instances.
• View a list of instances, information on instances and on access permissions assigned to them.
• Start and stop instance groups.
• View a list of instance groups and information on them.
• View the instance serial port output.
• View instance metadata.
• View a list of instance placement groups, information on instance placement groups and on access permissions assigned to them.
• View lists of instances in placement groups.
• View a list of dedicated host groups, information on dedicated host groups and on access permissions assigned to them.
• View lists of hosts and instances in dedicated host groups.
• View information on GPU clusters and instances included in GPU clusters, as well as the on access permissions assigned to these clusters.
• View a list of disks, information on disks and on access permissions assigned to them.
• View a list of file storages, information on file storages and on access permissions assigned to them.
• View a list of non-replicated disk placement groups, information on non-replicated disk placement groups and on access permissions assigned to them.
• View lists of disks in placement groups.
• View information on reserved instance pools.
• View a list of images, information on images and on access permissions assigned to them.
• View information on image families, on images within families, on the latest family image, as well as on access permissions assigned to image families.
• View a list of disk snapshots, information on disk snapshots and on access permissions assigned to them.
• View information on disk snapshot schedules and on access permissions assigned to them.
• View information on Compute Cloud resource and quota consumption and disk limits in the management console.
• View lists of resource operations for Compute Cloud, as well as information on these operations.
• View information on the status of configuring access via OS Login on instances.
• View information on available platforms.
• View a list of availability zones, information on availability zones and on access permissions assigned to them.

This role includes the compute.viewer permissions.

compute.snapshotSchedules.viewercompute.snapshotSchedules.viewer

The compute.snapshotSchedules.viewer role allows you to view information on scheduled disk snapshots.

Users with this role can:

• View information on disk snapshot schedules and on access permissions assigned to them.
• View lists of disks.
• View lists of disk snapshots.
• View a list of disk snapshot operations.

compute.snapshotSchedules.editorcompute.snapshotSchedules.editor

The compute.snapshotSchedules.editor role allows you to create, modify, and delete disk snapshot schedule, create and delete disk snapshots, as well as view information on disk snapshot operations.

Users with this role can:

• View information on disk snapshot schedules and on access permissions assigned to them, as well as create, modify, and delete disk snapshot schedules.
• View lists of disks and use disks to create snapshots.
• View lists of disk snapshots, create and delete snapshots.
• View a list of disk snapshot operations and information on them.

This role includes the compute.snapshotSchedules.viewer permissions.

iam.serviceAccounts.useriam.serviceAccounts.user

The iam.serviceAccounts.user role enables viewing the list of service accounts and info on them, as well as performing operations on behalf of a service account.

For example, if you specify a service account when creating an instance group, IAM will check whether you have a permission to use this service account.

For more information about service roles, see Roles in the Yandex Identity and Access Management documentation.

Primitive rolesPrimitive roles

Primitive roles allow users to perform actions in all Yandex Cloud services.

auditorauditor

The auditor role grants a permission to read configuration and metadata of any Yandex Cloud resources without any access to data.

For instance, users with this role can:

• View info on a resource.
• View the resource metadata.
• View the list of operations with a resource.

auditor is the most secure role that does not grant any access to the service data. This role suits the users who need minimum access to the Yandex Cloud resources.

viewerviewer

The viewer role grants the permissions to read the info on any Yandex Cloud resources.

This role includes the auditor permissions.

Unlike auditor, the viewer role provides access to service data in read mode.

editoreditor

The editor role provides permissions to manage any Yandex Cloud resources, except for assigning roles to other users, transferring organization ownership, removing an organization, and deleting Key Management Service encryption keys.

For instance, users with this role can create, modify, and delete resources.

This role includes the viewer permissions.

adminadmin

The admin role enables assigning any roles, except for resource-manager.clouds.owner and organization-manager.organizations.owner, and provides permissions to manage any Yandex Cloud resources (except for transferring organization ownership and removing an organization).

Prior to assigning the admin role for an organization, cloud, or billing account, make sure to check out the information on protecting privileged accounts.

This role includes the editor permissions.

Instead of primitive roles, we recommend using service roles with more granular access control, allowing you to implement the least privilege principle.

For more information about primitive roles, see the Yandex Cloud role reference.

What roles do I needWhat roles do I need

The table below lists the roles required for specific actions. You can always assign a role offering more permissions than the specified one. For example, you can assign the editor role instead of compute.editor, or the compute.viewer role for a folder instead of a separate VM or disk.

Action	Minimum required roles
Viewing data
Viewing information about any resource and access permissions assigned to any resource	compute.viewer for the resource
Viewing the list of VM instances in an instance group, viewing instance group logs	compute.viewer for the instance group
Viewing the list of disks in a disk placement group	compute.viewer for the disk placement group
Viewing the list of VM instances in a GPU cluster	compute.viewer for the GPU cluster
Viewing the list of virtual machines on a dedicated host, viewing the list of dedicated hosts in a dedicated host group	compute.viewer for the dedicated host group
Viewing a list of virtual machines in a placement group	compute.viewer for the placement group
Getting the VM serial port output	compute.viewer for the instance
Getting info about the the most relevant image in an image family	compute.viewer or compute.images.user for the image
Viewing information about disk snapshot schedules, viewing the list of disks attached to a specific disk snapshot schedule and the list of disk snapshots created based this schedule	compute.snapshotSchedules.viewer or compute.viewer for the schedule
Use of resources
Using any resource	compute.editor for the resource
Use of disks	compute.disks.user, compute.snapshotSchedules.editor, or compute.editor for the disk
Use of images	compute.images.user or compute.editor for the image
Managing resources
Creating a VM	compute.editor for the folder
Creating a VM with a public IP address	compute.editor and vpc.publicAdmin for the folder
Starting, stopping, and restarting virtual machines	compute.operator for the VM instance
Modifying and deleting a virtual machine	compute.editor for the VM instance
Linking a service account to a VM	compute.editor for the VM instance
Changing VM metadata	compute.editor for the VM instance
Attaching/detaching a disk to/from a VM	compute.editor for the instance
Attaching/detaching a file storage to/from a VM	compute.editor for the VM instance
Adding a network interface to a VM and deleting it from a VM, modifying a VM network interface	compute.editor for the instance
Assigning a public IP address to a VM and unassigning it from a VM	compute.editor for the instance
Assigning security groups to a VM	compute.editor for the VM instance
Moving a VM to another cloud folder	compute.editor for the VM instance
Simulating an instance maintenance event	compute.editor for the VM instance
Creating an instance group	compute.editor for the folder
Starting and stopping an instance group	compute.operator for the instance group
Changing and deleting an instance group	compute.editor for the instance group
Sequential restarting and recreating instances in a group	compute.operator for the instance group
Pausing and resuming instance group processes	compute.editor for the instance group
Creating a GPU cluster	compute.editor for the folder
Updating and deleting a GPU cluster	compute.editor for the GPU cluster
Creating a group of dedicated hosts	compute.editor for the folder
Updating and deleting a group of dedicated hosts, updating hosts in a group of dedicated hosts	compute.editor for the dedicated host group
Creating a reserved instance pool	compute.editor for the folder
Updating and deleting a reserved instance pool	compute.editor for the folder
Creating a placement group	compute.editor for the folder
Changing and deleting a placement group	compute.editor for the placement group
Creating a disk placement group	compute.editor for the folder
Changing and deleting a disk placement group	compute.editor for the disk placement group
Creating a disk	compute.editor for the folder
Updating and deleting a disk	compute.editor for the disk
Moving a disk to a different cloud folder	compute.editor for the disk
Creating a file storage	compute.editor for the folder
Updating and deleting a file storage	compute.editor for the file storage
Creating an image	compute.editor for the folder
Updating and deleting an image	compute.editor for the image
Creating a disk snapshot	compute.snapshotSchedules.editor or compute.editor for the folder
Deleting a disk snapshot	compute.snapshotSchedules.editor or compute.editor for the disk snapshot
Creating a disk snapshot schedule	compute.snapshotSchedules.editor or compute.editor for the folder
Starting, stopping, updating and deleting a disk snapshot schedule	compute.snapshotSchedules.editor or compute.editor for the schedule
Managing resource access
Assigning and revoking access permissions for any resource	compute.admin for the resource

What's nextWhat's next

• How to assign a role.
• How to revoke a role.
• Learn more about access management in Yandex Cloud.
• Learn more about role inheritance.