Revoke a role for a resource

If you do not have the Yandex Cloud CLI yet, install and initialize it.

To revoke a role from a subject, delete access permissions for the appropriate resource:

1. View the roles assigned for a resource:

   yc <service_name> <resource_category> list-access-bindings <resource_name_or_ID>
   

   Where:

   • <service_name>: Name of the service the resource belongs to, e.g., resource-manager.
   • <resource_category>: Resource category, e.g., folder.
   • <resource_name_or_ID>: Resource name or ID. You can specify a resource by its name or ID.

   For example, you can view the roles and the assignees for the default folder:

   yc resource-manager folder list-access-bindings default
   

   Result:

   +---------------------+----------------+----------------------+
   |       ROLE ID       |  SUBJECT TYPE  |      SUBJECT ID      |
   +---------------------+----------------+----------------------+
   | editor              | serviceAccount | ajepg0mjas06******** |
   | viewer              | userAccount    | aje6o61dvog2******** |
   +---------------------+----------------+----------------------+
   

2. To delete access permissions, run this command:

   yc <service_name> <resource_category> remove-access-binding \
       --id <resource_ID> \
       --role <role_ID> \
       --subject <subject_type>:<subject_ID>
   

   Where:

   • --id: ID of the resource to revoke the role from.

   • --role: ID of the role to revoke, e.g., resource-manager.clouds.owner.

   • --subject: Subject to revoke the role from.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and the corresponding CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. To revoke a resource role from a subject, find the resource description in the configuration file:

   resource "yandex_resourcemanager_cloud_iam_binding" "admin" {
       cloud_id    = "<cloud_ID>"
       role        = "<role>"
       members     = ["<subject_1>","<subject_2>,...,<subject_n>"]
   }
   

2. Delete the record with information about the subject whose permissions you need to revoke from the list of subjects titled members.

   Subject designations

   To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

   Subject type	Subject designation
   userAccount	userAccount:<user_ID>
   serviceAccount	serviceAccount:<service_account_ID>
   federatedUser	federatedUser:<user_ID>
   group	group:<group_ID>
   system	system:allAuthenticatedUsers (All authenticated users group)
   	system:allUsers (All users group)
   	system:group:organization:<organization_ID>:users (All users in organization X group)
   	system:group:federation:<federation_ID>:users (All users in federation N group)
   	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more on the properties of the yandex_resourcemanager_cloud_iam_binding resource, see this provider guide.

3. Make sure the configuration files are correct.

   1. In the terminal, navigate to the directory where you created your configuration file.
   2. Run a check using this command:

   terraform plan
   

   If the configuration is correct, the terminal will display a list of the resources and their settings. Otherwise, Terraform will show any detected errors.

4. Deploy the cloud resources.

   1. If the configuration is correct, run this command:

      terraform apply
      

   2. Confirm creating the resources by typing yes and pressing Enter.

   This will create all the resources you need in the specified folder. You can check the new resource using the management console or this CLI command:

   yc resource-manager cloud list-access-bindings <cloud_name_or_ID>
   

To revoke a resource role from a subject, delete the relevant access permissions:

1. View the roles and assignees for the resource using the listAccessBindings REST API method. For example, to view the roles for the b1gvmob95yys******** folder:

   export FOLDER_ID=b1gvmob95yys********
   export IAM_TOKEN=CggaATEVAgA...
   curl \
     --header "Authorization: Bearer ${IAM_TOKEN}" \
     "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:listAccessBindings"
   

   Result:

   {
     "accessBindings": [
     {
       "subject": {
         "id": "ajei8n54hmfh********",
         "type": "userAccount"
       },
       "roleId": "editor"
     }
     ]
   }
   

2. Create the request body, e.g., in the body.json file. In the request body, specify access permissions to delete. For example, revoke the editor role from the ajei8n54hmfh******** user:

   body.json:

   {
       "accessBindingDeltas": [{
           "action": "REMOVE",
           "accessBinding": {
               "roleId": "editor",
               "subject": {
                   "id": "ajei8n54hmfh********",
                   "type": "userAccount"
                   }
               }
           }
       ]
   }
   

3. Revoke a role by deleting the assigned permissions:

   export FOLDER_ID=b1gvmob95yys********
   export IAM_TOKEN=CggaAT********
   curl \
     --request POST \
     --header "Content-Type: application/json" \
     --header "Authorization: Bearer ${IAM_TOKEN}" \
     --data '@body.json' \
     "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:updateAccessBindings"