Configure your cloud
When a user registers with Yandex Cloud, a cloud is created for the user. The cloud is a separate workspace with this user as the owner. The default
folder and default
network will be created in the cloud.
The owner can create new folders and resources in this cloud, and manage access rights to them.
Create a folder
-
In the management console
, select the appropriate cloud in the list on the left. -
At the top right, click
Create folder. -
Enter the folder name. The naming requirements are as follows:
- The name must be from 3 to 63 characters long.
- It may contain lowercase Latin letters, numbers, and hyphens.
- The first character must be a letter and the last character cannot be a hyphen.
-
(Optional) Enter a description of the folder.
-
Select Create a default network. This will create a network with subnets in each availability zone. Within this network, a default security group will be created, inside which all network traffic is allowed.
-
Click Create.
-
View the description of the create folder command:
yc resource-manager folder create --help
-
Create a new folder:
-
with a name and without a description:
yc resource-manager folder create \ --name new-folder
The folder naming requirements are as follows:
- The name must be from 3 to 63 characters long.
- It may contain lowercase Latin letters, numbers, and hyphens.
- The first character must be a letter and the last character cannot be a hyphen.
-
with a name and description:
yc resource-manager folder create \ --name new-folder \ --description "my first folder with description"
-
Update a folder
The management console only allows you to change the name of a folder. To change its description, use the CLI or API.
- On the management console home page
, select the folder. This page displays folders for the selected cloud. You can switch to another cloud, if required. - Click
next to the folder and select Edit. - Enter a new name for the folder.
- Click Save.
-
View the description of the update folder command:
yc resource-manager folder update --help
-
If you know the folder ID or name, proceed to the next step. Otherwise, use one of these methods to get them:
-
Get a list of folders:
$ yc resource-manager folder list +----------------------+--------------------+--------+--------+-------------+ | ID | NAME | LABELS | STATUS | DESCRIPTION | +----------------------+--------------------+--------+--------+-------------+ | b1gppulhhm2aaufq9eug | yet-another-folder | | ACTIVE | | | b1gvmob95yysaplct532 | default | | ACTIVE | | +----------------------+--------------------+--------+--------+-------------+
-
If you know the ID of the resource that belongs to the required folder, you can get the folder ID from the information about that resource:
yc <SERVICE-NAME> <RESOURCE> get <RESOURCE-ID>
Where:
<SERVICE-NAME>
: Service name, e.g.,compute
.<RESOURCE>
: Resource category, e.g.,instance
.<RESOURCE-ID>
: Resource ID.
For example, the
fhmp74bfis2aim728p2a
VM belongs to theb1gpvjd9ir42nsng55ck
folder:yc compute instance get fhmp74bfis2ais728p2a id: fhmp74bfis2ais728p2a folder_id: b1gpvjd9ia42nsng55ck ...
-
-
Change the folder parameters, e.g., name and description. You can specify the folder to update by its name or ID.
yc resource-manager folder update default \ --new-name myfolder \ --description "this is my default-folder"
The command will rename the
default
folder tomyfolder
and update its description.The folder naming requirements are as follows:
- The name must be from 3 to 63 characters long.
- It may contain lowercase Latin letters, numbers, and hyphens.
- The first character must be a letter and the last character cannot be a hyphen.
Assign folder roles
-
Open the Users and roles
page for the selected cloud. If necessary, switch to another cloud. -
- On the left-hand panel, select a cloud.
- Click the Access bindings tab.
- Find the required user in the list. Assigned roles are specified in the Roles column.
- Select a folder in the Roles in folders section and click
. - Select a role from the list.
-
View the description of the command to assign a role for a folder:
yc resource-manager folder add-access-binding --help
-
Select a folder, e.g.,
my-folder
:yc resource-manager folder list +----------------------+-----------+--------+--------+ | ID | NAME | LABELS | STATUS | +----------------------+-----------+--------+--------+ | b1gd129pp9ha0vnvf5g7 | my-folder | | ACTIVE | +----------------------+-----------+--------+--------+
-
Choose the role.
yc iam role list +--------------------------------+-------------+ | ID | DESCRIPTION | +--------------------------------+-------------+ | admin | | | compute.images.user | | | editor | | | ... | | +--------------------------------+-------------+
-
Find out the user ID from the login or email address. To assign a role to a service account or a user group rather than to a single user, see the examples below.
yc iam user-account get test-user id: gfei8n54hmfhuk5nogse yandex_passport_user_account: login: test-user default_email: test-user@yandex.ru
-
Assign the
editor
role totest-user
formy-folder
. In the subject, specify theuserAccount
type and user ID:yc resource-manager folder add-access-binding my-folder \ --role editor \ --subject userAccount:gfei8n54hmfhuk5nogse
Use the updateAccessBindings method for the Folder resource. You will need the folder ID and the ID of the user to whom you want to assign the role for the folder.
-
Find out the folder ID using the list:
curl \ --header "Authorization: Bearer <IAM-TOKEN>" \ https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders?cloudId=b1gg8sgd16g7qca5onqs { "folders": [ { "id": "b1g66mft1vopnevbn57j", "cloudId": "b1gd129pp9ha0vnvf5g7", "createdAt": "2018-10-17T12:44:31Z", "name": "my-folder", "status": "ACTIVE" } ] }
-
Find out the user ID from the login using the getByLogin method:
curl \ --header "Authorization: Bearer <IAM-TOKEN>" \ https://iam.api.cloud.yandex.net/iam/v1/yandexPassportUserAccounts:byLogin?login=test-user { "id": "gfei8n54hmfhuk5nogse", "yandexPassportUserAccount": { "login": "test-user", "defaultEmail": "test-user@yandex.ru" } }
-
Assign the
editor
role to the user formy-folder
. Set theaction
property toADD
and specify theuserAccount
type and user ID in thesubject
property:curl \ --request POST \ --header 'Content-Type: application/json' \ --header "Authorization: Bearer <IAM-TOKEN>" \ --data '{ "accessBindingDeltas": [{ "action": "ADD", "accessBinding": { "roleId": "editor", "subject": { "id": "gfei8n54hmfhuk5nogse", "type": "userAccount" }}}]}' \ https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/b1gd129pp9ha0vnvf5g7:updateAccessBindings
Assign multiple roles
Follow the guide at the beginning of the section and assign the user multiple roles.
To assign a role to another user, select the user on the Users and roles
The add-access-binding
command allows you to add only one role. You can assign multiple roles using the set-access-binding
command.
Alert
The set-access-binding
method completely rewrites access permissions for the resource. All current resource roles will be deleted.
-
Make sure the resource has no roles assigned that you would not want to lose:
yc resource-manager folder list-access-binding my-folder
-
For example, assign a role to multiple users:
yc resource-manager folder set-access-bindings my-folder \ --access-binding role=editor,subject=userAccount:gfei8n54hmfhuk5nogse --access-binding role=viewer,subject=userAccount:helj89sfj80aj24nugsz
Assign the editor
role to one user and the viewer
role to another:
curl \
--request POST \
--header 'Content-Type: application/json' \
--header "Authorization: Bearer <IAM_TOKEN>" \
--data '{
"accessBindingDeltas": [{
"action": "ADD",
"accessBinding": {
"roleId": "editor",
"subject": {
"id": "gfei8n54hmfhuk5nogse",
"type": "userAccount"
}
}
},{
"action": "ADD",
"accessBinding": {
"roleId": "viewer",
"subject": {
"id": "helj89sfj80aj24nugsz",
"type": "userAccount"
}}}]}' \
https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/b1gd129pp9ha0vnvf5g7:updateAccessBindings
You can also assign roles using the setAccessBindings.
Alert
The setAccessBindings
method completely rewrites access permissions for the resource. All current resource roles will be deleted.
curl \
--request POST \
--header 'Content-Type: application/json' \
--header "Authorization: Bearer <IAM_TOKEN>" \
--data '{
"accessBindings": [{
"roleId": "editor",
"subject": { "id": "ajei8n54hmfhuk5nog0g", "type": "userAccount" }
},{
"roleId": "viewer",
"subject": { "id": "helj89sfj80aj24nugsz", "type": "userAccount" }
}]}' \
https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/b1gd129pp9ha0vnvf5g7:setAccessBindings
Grant folder access for a service account
You can assign a role not only for a folder but its child resources as well. These are listed in List of resources that you can assign roles for.
Allow the service account to manage the folder and its resources:
- In the management console
, select the appropriate folder. - Go to the Access bindings tab.
- Click Configure access.
- In the window that opens, select Service accounts.
- Select a service account from the list or use the search.
- Click
Add role and select the role in the folder. - Click Save.
-
Select the role to assign to the service account. You can find the description of the roles in the Yandex Identity and Access Management documentation in the Yandex Cloud role reference.
-
Find out the service account ID by its name:
yc iam service-account get my-robot
Result:
id: aje6o61dvog2******** folder_id: b1gvmob95yys******** created_at: "2018-10-15T18:01:25Z" name: my-robot
If you don't know the name of the service account, get a list of service accounts with their IDs:
yc iam service-account list
Result:
+----------------------+------------------+-----------------+ | ID | NAME | DESCRIPTION | +----------------------+------------------+-----------------+ | aje6o61dvog2******** | my-robot | my description | +----------------------+------------------+-----------------+
-
Assign the
viewer
role to themy-robot
service account using its ID:yc resource-manager folder add-access-binding my-folder \ --role viewer \ --subject serviceAccount:aje6o61dvog2********
To assign the service account a role for a cloud or folder, use the updateAccessBindings
REST API method for the Cloud or Folder resource:
-
Select the role to assign to the service account. You can find the description of the roles in the Yandex Identity and Access Management documentation in the Yandex Cloud role reference.
-
Get the ID of the service accounts folder.
-
Get an IAM token required for authorization in the Yandex Cloud API.
-
Get a list of folder service accounts to find out their IDs:
export FOLDER_ID=b1gvmob95yys******** export IAM_TOKEN=CggaATEVAgA... curl \ --header "Authorization: Bearer ${IAM_TOKEN}" \ "https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts?folderId=${FOLDER_ID}"
Result:
{ "serviceAccounts": [ { "id": "ajebqtreob2d********", "folderId": "b1gvmob95yys********", "createdAt": "2018-10-18T13:42:40Z", "name": "my-robot", "description": "my description" } ] }
-
Create the request body, e.g., in the
body.json
file. Set theaction
property toADD
androleId
to the appropriate role, such aseditor
, and specify theserviceAccount
type and service account ID in thesubject
property:body.json:
{ "accessBindingDeltas": [{ "action": "ADD", "accessBinding": { "roleId": "editor", "subject": { "id": "ajebqtreob2d********", "type": "serviceAccount" } } }] }
-
Assign a role to a service account. For example, for a folder with the
b1gvmob95yys********
ID:export FOLDER_ID=b1gvmob95yys******** export IAM_TOKEN=CggaAT******** curl \ --request POST \ --header "Content-Type: application/json" \ --header "Authorization: Bearer ${IAM_TOKEN}" \ --data '@body.json' \ "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:updateAccessBindings"