Viewing assigned roles

If you do not have the Yandex Cloud CLI yet, install and initialize it.

1. Get the account ID:

   1. Guide for service accounts.
   2. Guide for Yandex account users, federated users, and local users.

2. Get the resource ID or name.

3. View the roles assigned for the resource:

   yc <service_name> <resource_category> list-access-bindings <resource_name_or_ID>
   

   Where:

   • <service_name>: Name of the service the resource belongs to, e.g., resource-manager.
   • <resource_category>: Resource category, e.g., folder.
   • <resource_name_or_ID>: Resource name or ID. You can specify the resource by name or ID.

   For example, you can view the roles and the assignees for the default folder:

   yc resource-manager folder list-access-bindings default
   

   Result:

   +---------------------+----------------+----------------------+
   |       ROLE ID       |  SUBJECT TYPE  |      SUBJECT ID      |
   +---------------------+----------------+----------------------+
   | editor              | serviceAccount | ajepg0mjas06******** |
   | viewer              | userAccount    | aje6o61dvog2******** |
   +---------------------+----------------+----------------------+
   

   In the server response, find all rows where the subject contains the account ID, and the All users and All authenticated users public groups are specified as the subject.

4. Repeat the previous two steps for all parent resources.

1. Get the account ID:

   1. Guide for service accounts.
   2. Guide for Yandex account users, federated users, and local users.

2. Get the resource ID or name.

3. View the roles and assignees for the resource using the listAccessBindings REST API method. For example, to view roles for the b1gvmob95yys******** folder:

   export FOLDER_ID=b1gvmob95yys********
   export IAM_TOKEN=CggaATEVAgA...
   curl \
     --header "Authorization: Bearer ${IAM_TOKEN}" \
     "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:listAccessBindings"
   

   Result:

   {
     "accessBindings": [
     {
       "subject": {
         "id": "ajei8n54hmfh********",
         "type": "userAccount"
       },
       "roleId": "editor"
     }
     ]
   }
   

   In the server response, find all rows where the subject contains the account ID, and the All users and All authenticated users public groups are specified as the subject.

4. Repeat the previous two steps for all parent resources.