Contact UsGet started
© 2024 Direct Cursus Technology L.L.C.

Configure your cloud

Written by
Updated at December 4, 2024

When a user registers with Yandex Cloud, a cloud is created for the user. The cloud is a separate workspace with this user as the owner. In this cloud, the default folder and default network will be created.

The owner can create new folders and resources in this cloud, and manage access rights to them.

Create a folder

  1. In the management console, select the appropriate cloud from the list on the left.

  2. At the top right, click Create folder.

  3. Enter the folder name. The naming requirements are as follows:

    • The name must be from 3 to 63 characters long.
    • It may contain lowercase Latin letters, numbers, and hyphens.
    • The first character must be a letter and the last character cannot be a hyphen.

  4. (Optional) Enter a description of the folder.

  5. Select Create a default network. This will create a network with subnets in each availability zone. Within this network, a default security group will be created, inside which all network traffic is allowed.

  6. Click Create.

  1. View the description of the create folder command:

    yc resource-manager folder create --help

  2. Create a new folder:

    • with a name and without a description:

      yc resource-manager folder create \
    --name new-folder

      The folder naming requirements are as follows:

      • The name must be from 3 to 63 characters long.
      • It may contain lowercase Latin letters, numbers, and hyphens.
      • The first character must be a letter and the last character cannot be a hyphen.

    • with a name and description:

      yc resource-manager folder create \
    --name new-folder \
    --description "my first folder with description"

To create a folder, use the create method for the Folder.

Update a folder

The management console only allows you to change the name of a folder. To change its description, use the CLI or API.

  1. On the management console home page, select the folder. This page displays folders for the selected cloud. You can switch to another cloud, if required.
  2. Click next to the folder and select Edit.
  3. Enter a new name for the folder.
  4. Click Save.

  1. View the description of the update folder command:

    yc resource-manager folder update --help

  2. If you know the folder ID or name, proceed to the next step. Otherwise, use one of these methods to get them:

    • Get a list of folders:

      $ yc resource-manager folder list
+----------------------+--------------------+--------+--------+-------------+
|          ID          |        NAME        | LABELS | STATUS | DESCRIPTION |
+----------------------+--------------------+--------+--------+-------------+
| b1gppulhhm2aaufq9eug | yet-another-folder |        | ACTIVE |             |
| b1gvmob95yysaplct532 | default            |        | ACTIVE |             |
+----------------------+--------------------+--------+--------+-------------+

    • If you know the ID of the resource that belongs to the required folder, you can get the folder ID from the information about that resource:

      yc <SERVICE-NAME> <RESOURCE> get <RESOURCE-ID>

      Where:

      • <SERVICE-NAME>: Service name, e.g., compute.
      • <RESOURCE>: Resource category, e.g., instance.
      • <RESOURCE-ID>: Resource ID.

      For example, the fhmp74bfis2aim728p2a VM belongs to the b1gpvjd9ir42nsng55ck folder:

      yc compute instance get fhmp74bfis2ais728p2a
id: fhmp74bfis2ais728p2a
folder_id: b1gpvjd9ia42nsng55ck
...

  3. Change the folder parameters, e.g., name and description. You can specify the folder to update by its name or ID.

    yc resource-manager folder update default \
    --new-name myfolder \
    --description "this is my default-folder"

    The command will rename the default folder to myfolder and update its description.

    The folder naming requirements are as follows:

    • The name must be from 3 to 63 characters long.
    • It may contain lowercase Latin letters, numbers, and hyphens.
    • The first character must be a letter and the last character cannot be a hyphen.

To edit the folder, use the update method for the Folder resource.

Assign folder roles

  1. In the management console, select the appropriate cloud from the list on the left.
  2. Go to the Access bindings tab.
  3. Click next to the user and select Edit roles.
  4. In the window that opens, click Add role and select the role from the list.
  5. Click Save.

  1. View the description of the command to assign a role for a folder:

    yc resource-manager folder add-access-binding --help

  2. Select a folder, e.g., my-folder:

    yc resource-manager folder list
+----------------------+-----------+--------+--------+
|          ID          |   NAME    | LABELS | STATUS |
+----------------------+-----------+--------+--------+
| b1gd129pp9ha0vnvf5g7 | my-folder |        | ACTIVE |
+----------------------+-----------+--------+--------+

  3. Choose the role.

    yc iam role list
+--------------------------------+-------------+
|               ID               | DESCRIPTION |
+--------------------------------+-------------+
| admin                          |             |
| compute.images.user            |             |
| editor                         |             |
| ...                            |             |
+--------------------------------+-------------+

  4. Find out the user ID from the login or email address. To assign a role to a service account or a user group rather than to a single user, see the examples below.

    yc iam user-account get test-user
id: gfei8n54hmfhuk5nogse
yandex_passport_user_account:
    login: test-user
    default_email: test-user@yandex.ru

  5. Assign the editor role to test-user for my-folder. In the subject, specify the userAccount type and user ID:

    yc resource-manager folder add-access-binding my-folder \
    --role editor \
    --subject userAccount:gfei8n54hmfhuk5nogse

Use the updateAccessBindings method for the Folder resource. You will need the folder ID and the ID of the user to whom you want to assign the role for the folder.

  1. Find out the folder ID using the list:

    curl \
  --header "Authorization: Bearer <IAM-TOKEN>" \
  https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders?cloudId=b1gg8sgd16g7qca5onqs

{
 "folders": [
  {
   "id": "b1g66mft1vopnevbn57j",
   "cloudId": "b1gd129pp9ha0vnvf5g7",
   "createdAt": "2018-10-17T12:44:31Z",
   "name": "my-folder",
   "status": "ACTIVE"
  }
 ]
}

  2. Find out the user ID from the login using the getByLogin method:

    curl \
    --header "Authorization: Bearer <IAM-TOKEN>" \
    https://iam.api.cloud.yandex.net/iam/v1/yandexPassportUserAccounts:byLogin?login=test-user

{
 "id": "gfei8n54hmfhuk5nogse",
 "yandexPassportUserAccount": {
  "login": "test-user",
  "defaultEmail": "test-user@yandex.ru"
 }
}

  3. Assign the editor role to the user for my-folder. Set the action property to ADD and specify the userAccount type and user ID in the subject property:

    curl \
    --request POST \
    --header 'Content-Type: application/json' \
    --header "Authorization: Bearer <IAM-TOKEN>" \
    --data '{
    "accessBindingDeltas": [{
        "action": "ADD",
        "accessBinding": {
            "roleId": "editor",
            "subject": {
                "id": "gfei8n54hmfhuk5nogse",
                "type": "userAccount"
    }}}]}' \
    https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/b1gd129pp9ha0vnvf5g7:updateAccessBindings

Assign multiple roles

Follow the steps above to assign multiple roles to the user.

The add-access-binding command allows you to add only one role. You can assign multiple roles using the set-access-binding command.

Alert

The set-access-binding method completely rewrites access permissions for the resource. All current resource roles will be deleted.

  1. Make sure the resource has no roles assigned that you would not want to lose:

    yc resource-manager folder list-access-binding my-folder

  2. For example, assign a role to multiple users:

    yc resource-manager folder set-access-bindings my-folder \
    --access-binding role=editor,subject=userAccount:gfei8n54hmfhuk5nogse
    --access-binding role=viewer,subject=userAccount:helj89sfj80aj24nugsz

Assign the editor role to one user and the viewer role to another user:

curl \
    --request POST \
    --header 'Content-Type: application/json' \
    --header "Authorization: Bearer <IAM_TOKEN>" \
    --data '{
    "accessBindingDeltas": [{
        "action": "ADD",
        "accessBinding": {
            "roleId": "editor",
            "subject": {
                "id": "gfei8n54hmfhuk5nogse",
                "type": "userAccount"
            }
        }
    },{
        "action": "ADD",
        "accessBinding": {
            "roleId": "viewer",
            "subject": {
                "id": "helj89sfj80aj24nugsz",
                "type": "userAccount"
    }}}]}' \
    https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/b1gd129pp9ha0vnvf5g7:updateAccessBindings

You can also assign roles using the setAccessBindings.

Alert

The setAccessBindings method completely rewrites access permissions for the resource. All current resource roles will be deleted.

curl \
    --request POST \
    --header 'Content-Type: application/json' \
    --header "Authorization: Bearer <IAM_TOKEN>" \
    --data '{
    "accessBindings": [{
        "roleId": "editor",
        "subject": { "id": "ajei8n54hmfhuk5nog0g", "type": "userAccount" }
    },{
        "roleId": "viewer",
        "subject": { "id": "helj89sfj80aj24nugsz", "type": "userAccount" }
    }]}' \
    https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/b1gd129pp9ha0vnvf5g7:setAccessBindings

Grant folder access for a service account

You can assign a role not only for a folder but its child resources as well. These are listed in List of resources you can assign roles for.

Allow the service account to manage the folder and its resources:

  1. In the management console, select the appropriate folder.
  2. Go to the Access bindings tab.
  3. Click Configure access.
  4. In the window that opens, select Service accounts.
  5. Select a service account from the list or use the search.
  6. Click Add role and select the role in the folder.
  7. Click Save.

  1. Select the role to assign to the service account. You can find the description of the roles in the Yandex Identity and Access Management documentation in the Yandex Cloud role reference.

  2. Find out the service account ID by its name:

    yc iam service-account get my-robot

    Result:

    id: aje6o61dvog2********
folder_id: b1gvmob95yys********
created_at: "2018-10-15T18:01:25Z"
name: my-robot

    If you don't know the name of the service account, get a list of service accounts with their IDs:

    yc iam service-account list

    Result:

    +----------------------+------------------+-----------------+
|          ID          |       NAME       |   DESCRIPTION   |
+----------------------+------------------+-----------------+
| aje6o61dvog2******** | my-robot         | my description  |
+----------------------+------------------+-----------------+

  3. Assign the viewer role to the my-robot service account using its ID:

    yc resource-manager folder add-access-binding my-folder \
  --role viewer \
  --subject serviceAccount:aje6o61dvog2********

To assign the service account a role for a cloud or folder, use the updateAccessBindings REST API method for the Cloud or Folder resource:

  1. Select the role to assign to the service account. You can find the description of the roles in the Yandex Identity and Access Management documentation in the Yandex Cloud role reference.

  2. Get the ID of the service accounts folder.

  3. Get an IAM token required for authorization in the Yandex Cloud API.

  4. Get a list of folder service accounts to find out their IDs:

    export FOLDER_ID=b1gvmob95yys********
export IAM_TOKEN=CggaATEVAgA...
curl \
  --header "Authorization: Bearer ${IAM_TOKEN}" \
  "https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts?folderId=${FOLDER_ID}"

    Result:

    {
 "serviceAccounts": [
  {
   "id": "ajebqtreob2d********",
   "folderId": "b1gvmob95yys********",
   "createdAt": "2018-10-18T13:42:40Z",
   "name": "my-robot",
   "description": "my description"
  }
 ]
}

  5. Create the request body, e.g., in the body.json file. Set the action property to ADD and roleId to the appropriate role, such as editor, and specify the serviceAccount type and service account ID in the subject property:

    body.json:

    {
  "accessBindingDeltas": [{
    "action": "ADD",
    "accessBinding": {
      "roleId": "editor",
      "subject": {
        "id": "ajebqtreob2d********",
        "type": "serviceAccount"
      }
    }
  }]
}

  6. Assign a role to a service account. For example, for a folder with the b1gvmob95yys******** ID:

    export FOLDER_ID=b1gvmob95yys********
export IAM_TOKEN=CggaAT********
curl \
  --request POST \
  --header "Content-Type: application/json" \
  --header "Authorization: Bearer ${IAM_TOKEN}" \
  --data '@body.json' \
  "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:updateAccessBindings"
Previous
Step 5. Managing users
Next
Step 7. Setting up a secure network configuration