Creating a service account
Warning
Creating service accounts may be prohibited by access policies at the folder, cloud, or organization level.
Create a service account to manage resources under a different account.
You must have the iam.serviceAccounts.admin role or higher for the folder to create a service account.
Note
A service account is created inside a folder. Once a service account has been created, you cannot change the folder.
You can assign roles to a service account for any resources in any cloud if these resources belong to the same organization as the service account. You can also assign roles to a service account for the organization.
Create a service account
-
In the management console, click or in the top panel and select the folder.
-
Navigate to Identity and Access Management.
-
Click Create service account.
-
Enter a name for the service account.
The naming requirements are as follows:
- Length: between 3 and 63 characters.
- It can only contain lowercase Latin letters, numbers, and hyphens.
- It must start with a letter and cannot end with a hyphen.
Make sure the service account name is unique within your cloud.
-
Click Create.
If you do not have the Yandex Cloud CLI yet, install and initialize it.
The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
-
View the description of the command for creating a service account:
yc iam service-account create --help -
Create a service account named
my-robot:yc iam service-account create --name my-robotThe naming requirements are as follows:
- Length: between 3 and 63 characters.
- It can only contain lowercase Latin letters, numbers, and hyphens.
- It must start with a letter and cannot end with a hyphen.
If you do not have Terraform yet, install it and configure the Yandex Cloud provider.
To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.
-
In the configuration file, specify the properties of the resources you want to create:
resource "yandex_iam_service_account" "sa" { name = "<service_account_name>" description = "<service_account_description>" folder_id = "<folder_ID>" }name: Service account name. This is a required parameter.description: Service account description. This is an optional setting.folder_id: Folder ID. This is an optional setting. It defaults to the value specified in the provider settings.
For more on the properties of the
yandex_iam_service_accountresource in Terraform, see this provider guide. -
Make sure the configuration files are correct.
-
In the terminal, navigate to the directory where you created your configuration file.
-
Run a check using this command:
terraform plan
If the configuration description is correct, the terminal will display information about the service account. Otherwise, Terraform will show any detected errors.
-
-
Deploy the cloud resources.
-
If the configuration is correct, run this command:
terraform apply -
Confirm creating the service account by typing
yesin the terminal and pressing Enter.This will create the service account. You can check it using the management console or this CLI command:
yc iam service-account list
-
To create a service account, use the create REST API method for the ServiceAccount resource or the ServiceAccountService/Create gRPC API call.
Examples
Add a description when creating a service account
Create a service account with the following name and description:
yc iam service-account create --name my-robot \
--description "this is my favorite service account"
resource "yandex_iam_service_account" "sa" {
name = "my-robot"
description = "this is my favorite service account"
}
curl \
--request POST \
--header 'Content-Type: application/json' \
--header "Authorization: Bearer <IAM_token>" \
--data '{
"folderId": "b1gvmob95yys********",
"name": "my-robot",
"description": "this is my favorite service account"
}' \
https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts