Assigning roles

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To assign a role for a cloud or folder:

1. View the description of the CLI command for assigning roles:

   yc resource-manager <cloud_or_folder> add-access-binding --help
   

   Specify cloud for a cloud or folder for a folder.

2. Get a list of available clouds or folders with their IDs:

   yc resource-manager <cloud_or_folder> list
   

3. Get the ID of the user, service account, user group, organization, or identity federation to which or the users of which you are assigning a role.

4. To assign a role, run this command:

   yc resource-manager <cloud_or_folder> add-access-binding \
     --id <cloud_or_folder_ID> \
     --role <role_ID> \
     --subject <subject_type>:<subject_ID>
   

   Where:

   • --id: ID of the resource to assign the role for.

   • --role: ID of the role you need to assign, e.g., resource-manager.clouds.owner.

   • --subject: Subject getting the role.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and the corresponding CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

   For example, to assign a service account the viewer role for the folder:

   yc resource-manager folder add-access-binding \
     --id b1g672qpemb4******** \
     --role viewer \
     --subject serviceAccount:aje8m5luj4qf********
   

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. Describe the roles you are assigning in the configuration file:

   Here is an example of the configuration file structure:

   // Assigning a role for the cloud
   resource "yandex_resourcemanager_cloud_iam_member" "cloud_member" {
     cloud_id = "<cloud_ID>"
     role     = "<role>"
     member   = "<subject>"
   }
   
   // Assigning a role for the folder
   resource "yandex_resourcemanager_folder_iam_member" "folder_member" {
     folder_id = "<folder_ID>"
     role      = "<role>"
     member    = "<subject>"
   }
   

   Where:

   • cloud_id: Cloud ID. You can get a list of available clouds using the CLI command: yc resource-manager cloud list. This is a required setting.

   • folder_id: Folder ID You can get the list of available folders using the yc resource-manager cloud list CLI command. This is a required setting.

   • role: Role you need to assign. You can get a list of roles using the CLI command: yc iam role list. In one resource, only one role can be assigned. This is a required setting.

   • member: Subject getting the role. This is a required setting.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more on the properties of Terraform resources, see this provider guide.

2. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   This will create the necessary resources in the organization.

To assign a role for a cloud, use the updateAccessBindings REST API method for the Cloud resource or the CloudService/UpdateAccessBindings gRPC API call.

To assign a role for a folder, use the updateAccessBindings REST API method for the Folder resource or the FolderService/UpdateAccessBindings gRPC API call.

Provide the following in the request:

• ADD value in the accessBindingDeltas[].action parameter to add a role.

• Role in the accessBindingDeltas[].accessBinding.roleId parameter.

• ID of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.id parameter.

• Type of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.type parameter.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To assign a role for an organization:

1. View the description of the CLI command for assigning roles:

   yc organization-manager organization add-access-binding --help
   

2. Get a list of available organizations with their IDs:

   yc organization-manager organization list
   

3. Get the ID of the user, service account, user group, organization, or identity federation to which or the users of which you are assigning a role.

4. To assign a role, run this command:

   yc organization-manager organization add-access-binding \
     --id <organization_ID> \
     --role <role_ID> \
     --subject <subject_type>:<subject_ID>
   

   Where:

   • --id: ID of the resource to assign the role for.

   • --role: ID of the role you need to assign, e.g., resource-manager.clouds.owner.

   • --subject: Subject getting the role.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and the corresponding CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

   For example, to assign a service account the viewer role for the organization:

   yc organization-manager organization add-access-binding \
     --id org672qpemb4******** \
     --role viewer \
     --subject serviceAccount:aje8m5luj4qf********
   

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

To assign a role for an organization:

1. Get the ID of the user, service account, or user group you are assigning a role to.

2. Describe the resource with the role for the organization in the configuration file.

   Here is an example of the configuration file structure:

   resource "yandex_organizationmanager_organization_iam_binding" "<resource_name>" {
     organization_id = "<organization_ID>"
     role            = "<role>"
     member          = "<subject>"
   }
   

   Where:

   • organization_id: Organization ID. This is a required setting.

   • role: Role. For each role, you can only use one yandex_organizationmanager_organization_iam_binding resource. This is a required setting.

   • member: Subject getting the role. This is a required setting.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more information, see this provider guide.

3. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   This will create the necessary resources in the organization. You can check the new resources using the management console or this CLI command:

   yc organization-manager organization list-access-bindings <organization_name_or_ID>
   

To assign a role for the organization, use the updateAccessBindings REST API method for the Organization resource or the OrganizationService/UpdateAccessBindings gRPC API call and provide the following in the request:

• ADD value in the accessBindingDeltas[].action parameter to add a role.

• Role in the accessBindingDeltas[].accessBinding.roleId parameter.

• ID of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.id parameter.

• Type of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.type parameter.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To assign a role for a resource:

1. View the description of the CLI command for assigning roles:

   yc <service_name> <resource> add-access-binding --help
   

   Example for a Yandex Compute Cloud VM:

   yc compute instance add-access-binding --help
   

2. Get a list of resources with their IDs:

   yc <service_name> <resource> list
   

3. Get the ID of the user, service account, user group, organization, or identity federation to which or the users of which you are assigning a role.

4. To assign a role, run this command:

   yc <service_name> <resource> add-access-binding \
     --id <resource_ID> \
     --role <role_ID> \
     --subject <subject_type>:<subject_ID>
   

   Where:

   • --id: ID of the resource to assign the role for.

   • --role: ID of the role you need to assign, e.g., resource-manager.clouds.owner.

   • --subject: Subject getting the role.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and the corresponding CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

   For example, to assign a service account the viewer role for the VM:

   yc compute instance add-access-binding \
     --id ins672qpemb4******** \
     --role viewer \
     --subject serviceAccount:aje8m5luj4qf********
   

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

To assign a role for an organization:

1. Get the ID of the user, service account, or user group you are assigning a role to.

2. Describe the resource with the role for the organization in the configuration file.

   Sample configuration file structure for assigning a role to a folder:

   resource "yandex_resourcemanager_folder_iam_member" "admin-account-iam" {
     folder_id   = "<folder_ID>"
     role        = "<role>"
     member      = "<subject>"
   }
   

   Where:

   • folder_id: Folder ID. This is a required setting.

   • role: Role. For each role, you can only use one yandex_organizationmanager_organization_iam_binding resource. This is a required setting.

   • member: Subject getting the role. This is a required setting.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more information, see this provider guide.

3. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   This will create the necessary resources in the organization. You can check the new resources using the management console or CLI commands.

To assign a role for a resource, use the updateAccessBindings REST API method or gRPC API call for the resource and provide the following in the request:

• ADD value in the accessBindingDeltas[].action parameter to add a role.

• Role in the accessBindingDeltas[].accessBinding.roleId parameter.

• ID of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.id parameter.

• Type of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.type parameter.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To assign multiple roles for a resource:

1. Make sure the resource has no important roles assigned before proceeding:

   yc <service_name> <resource> list-access-bindings \
      --id <resource_ID>
   

   Example for a Yandex Compute Cloud VM:

   yc compute instance list-access-bindings \
      --id <VM_ID>
   

2. View the description of the CLI command for assigning roles:

   yc <service_name> <resource> set-access-bindings --help
   

3. Get a list of resources with their IDs:

   yc <service_name> <resource> list
   

4. Get the ID of the user, service account, user group, organization, or identity federation to which or the users of which you are assigning a role.

5. To assign a role, run this command:

   yc <service_name> <resource> set-access-bindings \
     --id <resource_ID> \
     --access-binding role=<role>,subject=<subject_type>:<subject_ID>
   

   Where:

   • --id: ID of the resource to assign the role for.

   • role: ID of the role you need to assign, e.g., resource-manager.clouds.owner.

   • subject: Subject getting the role.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and the corresponding CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

   Provide a separate --access-binding parameter for each role. For example, to assign a service account multiple roles for a VM:

   yc compute instance set-access-bindings \
      --id ins672qpemb4******** \
      --access-binding role=compute.disks.user,subject=<subject_type>:aje8m5luj4qf******** \
      --access-binding role=compute.images.user,subject=<subject_type>:aje8m5luj4qf******** \
      --access-binding role=compute.operator,subject=<subject_type>:aje8m5luj4qf********
   

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. Describe the roles you are assigning in the configuration file:

   Sample configuration file structure for assigning multiple roles for a cloud:

   resource "yandex_resourcemanager_cloud_iam_member" "cloud_member_1" {
     cloud_id = "<cloud_ID>"
     role     = "<role_1>"
     members  = ["<subject_1>","<subject_2>,...,<subject_n>"]
   }
   
   resource "yandex_resourcemanager_cloud_iam_member" "cloud_member_2" {
     cloud_id  = "<cloud_ID>"
     role      = "<role_2>"
     members   = ["<subject_1>","<subject_2>,...,<subject_n>"]
   }
   

   Where:

   • cloud_id: Cloud ID. You can get a list of available clouds using the CLI command: yc resource-manager cloud list. This is a required setting.

   • role: Role you need to assign. You can get a list of roles using the CLI command: yc iam role list. In one yandex_resourcemanager_cloud_iam_member resource, only one role can be assigned. This is a required setting.

   • members: Designations of subjects getting the role. This is a required setting.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more on the properties of Terraform resources, see this provider guide.

2. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   This will create the necessary resources in the organization.

To assign multiple roles for a resource, use the setAccessBindings REST API method or gRPC API call for the resource. In your request, provide an array of objects, each one matching a particular role and containing the following data:

• Role in the accessBindings[].roleId parameter.

• ID of the subject getting the roles in the accessBindings[].subject.id parameter.

• Type of the subject getting the roles in the accessBindings[].subject.type parameter.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)