Accounts in Yandex Cloud

Yandex Cloud uses Yandex accounts, service accounts, federated accounts, and local accounts.

Yandex accountYandex account

Yandex account: Your Yandex or Yandex 360 account. Use this account type in the following cases:

• If you do not need to set up access permissions for your applications. Otherwise, use a service account.
• For smaller teams if you did not set up an identity federation in your organization (e.g., with Active Directory or Google Workspace). Otherwise, use federated accounts.

To better safeguard your resources from unauthorized access:

1. Enable two-factor authentication for your Yandex account.
2. Request users you add to your organization to enable two-factor authentication as well.
3. In the organization security settings, enable the two-factor authentication requirement. This way, only users with two-factor authentication enabled will be able to access resources.

Use casesUse cases

• Creating an interactive serverless application using WebSocket

Federated accountFederated account

A federated account is a user account from an identity federation, e.g., Active Directory.

With identity federations, a business can enable single sign-on to Yandex Cloud via their server. This allows the company employees use their corporate accounts to access Yandex Cloud.

Use federated accounts if you need to grant Yandex Cloud access to a large number of employees.

For more information, see SAML-compatible identity federations.

Use casesUse cases

• Auto Unseal in Hashicorp Vault

Local userLocal user

Local users are linked only to the domain, their credentials are stored only in Yandex Cloud as part of a user pool. Local users are created in a user pool, exist within a single organization, and cannot create a new one. The pool administrator can flexibly configure authentication, including by setting a password policy, and set the expiration date for local user accounts.

Use local users if you need to manage employee accounts centrally directly in Yandex Cloud.

Local users get authenticated in Yandex Cloud with the help of Login Discovery without using any external authentication providers.

Service accountService account

A service account is an account that can be used by a program to manage resources in Yandex Cloud.

Service accounts allow you to set up flexible access to your resources and minimize risks associated with excessive permissions. Use this account type for your applications, CLI, Terraform, and Yandex Cloud API. For more information, see Service accounts.

Use casesUse cases

• Getting started with Terraform