Revoke a role for a resource

Written by

Updated at August 2, 2024

If you want to prevent a subject from accessing a resource, revoke the relevant roles for this resource and for resources that grant inherited access rights. For more information, see How access management works in Yandex Cloud.

Revoking a role

Management console

CLI

Terraform

API

To revoke a role in the folder and its child resources:
1. On the start page of the management console, select the folder.
2. Go to the Access bindings tab.
3. Select a user from the list and click next to the username.
4. Click Edit roles.
5. Click next to the role you wish to revoke.
6. Click Save.
To revoke a role in the cloud:
1. On the start page of the management console, select the cloud.
2. Go to the Access bindings tab.
3. Select a user from the list and click next to the username.
4. Click Edit roles.
5. Click next to the role you wish to revoke.
6. Click Save.
To revoke all the folder or cloud roles at once:
1. On the management console start page, select a folder or a cloud.
2. Go to the Access bindings tab.
3. Select a user from the list and click next to the username.
4. If you want to revoke all of the user's roles in the cloud, click Remove bindings and confirm the revocation.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

To revoke a role from a subject, delete the corresponding access binding for the appropriate resource:

View the roles assigned for a resource:

yc <service_name> <resource_category> list-access-bindings <resource_name_or_ID>

Where:

<service_name>: Name of the service the resource belongs to, e.g., resource-manager.
<resource_category: Resource category, e.g., folder.
<resource_name_or_ID>: Name or ID of the resource. You can specify a resource by its name or ID.

For example, you can view what roles were assigned for the default folder and to whom:

yc resource-manager folder list-access-bindings default

Output:

+---------------------+----------------+----------------------+
|       ROLE ID       |  SUBJECT TYPE  |      SUBJECT ID      |
+---------------------+----------------+----------------------+
| editor              | serviceAccount | ajepg0mjas06******** |
| viewer              | userAccount    | aje6o61dvog2******** |
+---------------------+----------------+----------------------+

To delete an access binding, run:
```
yc <service_name> <resource_category> remove-access-binding <resource_name_or_ID> \
    --role <role_ID> \
    --subject <subject_type>:<subject_ID>
```
Where:
- --role: ID of the role to be revoked, e.g., resource-manager.clouds.owner.
- <subject-type>: Subject type to revoke a role from.
- <subject_ID>: Subject ID.

If you don't have Terraform, install it and configure the Yandex Cloud provider.

To revoke a resource role from a subject, find the resource description in the configuration file:

resource "yandex_resourcemanager_cloud_iam_binding" "admin" {
    cloud_id    = "<cloud_ID>"
    role        = "<role>"
    members     = [
    "serviceAccount:<service_account_ID>",
    "userAccount:<user_ID>",
    ]
}

Delete the entry with information about the subject which rights are to be revoked from the members list of users.

For more information about the parameters of the yandex_resourcemanager_cloud_iam_binding resource, see the provider documentation.
Make sure the configuration files are correct.
1. In the command line, go to the folder where you created the configuration file.
2. Run the check using the command:
```
terraform plan
```
If the configuration is described correctly, the terminal displays a list of created resources and their parameters. If the configuration contains any errors, Terraform will point them out.
Deploy cloud resources.
1. If the configuration contains no errors, run the command:
```
terraform apply
```
2. Confirm creating the resources: type yes in the terminal and press Enter.
All the resources you need will then be created in the specified folder. You can check the new resource using the management console or this CLI command:
```
yc resource-manager cloud list-access-bindings <cloud_name_or_ID>
```

To revoke a resource role from a subject, delete the corresponding access binding:

View who has which roles assigned for working with a resource using the listAccessBindings REST API method. For example, to view the roles for the b1gvmob95yys******** folder:

export FOLDER_ID=b1gvmob95yys********
export IAM_TOKEN=CggaATEVAgA...
curl -H "Authorization: Bearer ${IAM_TOKEN}" "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:listAccessBindings"

Output:

{
  "accessBindings": [
  {
    "subject": {
      "id": "ajei8n54hmfh********",
      "type": "userAccount"
    },
    "roleId": "editor"
  }
  ]
}

Create the request body, for example, in the body.json file. In the request body, specify which access binding to delete. For example, revoke the editor role from the ajei8n54hmfh******** user:

body.json:

{
    "accessBindingDeltas": [{
        "action": "REMOVE",
        "accessBinding": {
            "roleId": "editor",
            "subject": {
                "id": "ajei8n54hmfh********",
                "type": "userAccount"
                }
            }
        }
    ]
}

Revoke the role by deleting the specified access binding:

export FOLDER_ID=b1gvmob95yys********
export IAM_TOKEN=CggaAT********
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${IAM_TOKEN}" \
  -d '@body.json' \
  "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:updateAccessBindings"

Revoke a role for a resource

Revoking a roleRevoking a role

Was the article helpful?

Revoking a role