Yandex Cloud
Search
Contact UsTry it for free
  • Customer Stories
  • Documentation
  • Blog
  • All Services
  • System Status
    • Featured
    • Infrastructure & Network
    • Data Platform
    • Containers
    • Developer tools
    • Serverless
    • Security
    • Monitoring & Resources
    • AI for business
    • Business tools
  • All Solutions
    • By industry
    • By use case
    • Economics and Pricing
    • Security
    • Technical Support
    • Start testing with double trial credits
    • Cloud credits to scale your IT product
    • Gateway to Russia
    • Cloud for Startups
    • Center for Technologies and Society
    • Yandex Cloud Partner program
    • Price calculator
    • Pricing plans
  • Customer Stories
  • Documentation
  • Blog
© 2025 Direct Cursus Technology L.L.C.
Yandex Identity and Access Management
    • Overview
      • Overview
      • Roles
      • System groups
      • Public groups
      • Resources that roles can be assigned for
      • Impersonation
    • Service access to user resources
    • Identity federations
    • Workload identity federations
    • Quotas and limits
  • Secure use of Yandex Cloud
  • Access management
  • Pricing policy
  • Role reference
  • Terraform reference
  • Monitoring metrics
  • Audit Trails events
  • Release notes
  1. Concepts
  2. How access management works
  3. Impersonation

Impersonation

Written by
Yandex Cloud
Updated at October 29, 2025

Impersonation is when a user performs actions with cloud resources under a service account with appropriate access permissions. Impersonation is mostly used to temporarily expand user permissions without generating static credentials for the user.

For example, impersonation can help you out when the user has no permissions to view a folder, but needs to for a short while. The administrator may then assign the viewer role for the folder to the service account and the special iam.serviceAccounts.tokenCreator role to the user. This will allow the user to view the folder's resources under the service account or get the service account's IAM token. However, the user will not be able to edit permissions or delete the service account.

The administrator can revoke the iam.serviceAccounts.tokenCreator role from the user whenever needed. The user will then lose the ability to view the folder under the service account.

See alsoSee also

  • Using impersonation

Was the article helpful?

Previous
Resources that roles can be assigned for
Next
How to choose the correct authentication method
© 2025 Direct Cursus Technology L.L.C.