Creating static access keys

Written by

Updated at November 18, 2024

Examples
- Add a description when creating a service account

Follow this guide to learn how to create static access keys for a service account when using services that support this authorization method.

If you do not have a service account yet, create one and assign roles to it.

To create a static access key:

Management console

CLI

Terraform

API

In the management console, navigate to the folder the service account belongs to.
In the list of services, select Identity and Access Management.
In the left-hand panel, select Service accounts.
Select the service account to create a static access key for.
Click Create new key in the top panel.
Select Create static access key.
Specify the key description and click Create.
Save the ID and secret key.

Alert

After you close the dialog, the private key value will become unavailable.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

See the description of the create static access key command:
```
yc iam access-key create --help
```

Select a service account, e.g., my-robot:

yc iam service-account list

Result:

+----------------------+------------------+-------------------------------+
|          ID          |       NAME       |          DESCRIPTION          |
+----------------------+------------------+-------------------------------+
| aje6o61dvog2******** | my-robot         |                               |
| aje9sda1ufvq******** | account_name     | account_description           |
+----------------------+------------------+-------------------------------+

Create an access key for the my-robot service account:

yc iam access-key create --service-account-name my-robot

Result:

access_key:
  id: aje6t3vsbj8l********
  service_account_id: ajepg0mjt06s********
  created_at: "2018-11-22T14:37:51Z"
  key_id: 0n8X6WY6S24N********
secret: JyTRFdqw8t1kh2-OJNz4JX5ZTz9Dj1rI********

Save the ID (key_id) and secret key (secret). You will not be able to get the key value again.

If you don't have Terraform, install it and configure the Yandex Cloud provider.

In the configuration file, describe the parameters of the resources you want to create:
```
resource "yandex_iam_service_account_static_access_key" "sa-static-key" {
 service_account_id = "<service_account_ID>"
 description        = "<key_description>"
 pgp_key            = "keybase:keybaseusername"
 }
```
Where:
- service_account_id: Service account ID. This is a required parameter.
- description: Key description. This is an optional parameter.
- pgp_key: Additional PGP key for encrypting a private key. This is an optional parameter. Specify the public part of the key in Base64 encoding or in keybase:keybaseusername format.
For more information about the yandex_iam_service_account_static_access_key resource parameters in Terraform, see the relevant provider documentation.
Make sure the configuration files are correct.
1. In the command line, go to the folder where you created the configuration file.
2. Run a check using this command:
```
terraform plan
```
If the configuration is described correctly, the terminal will display a list of created resources and their parameters. If the configuration contains any errors, Terraform will point them out.
Deploy cloud resources.
1. If the configuration does not contain any errors, run this command:
```
terraform apply
```
2. Confirm the static access key creation by typing yes in the terminal and pressing Enter.
  
  If any errors occur when creating the key, Terraform will indicate them.
  If the key is successfully created, Terraform will write it into its configuration, but will not show it to the user. The terminal will display only the ID of the created key.
  
  You can check the new service account key in the management console or using the CLI command:
```
yc iam access-key list --service-account-name=<service_account_name>
```

To create an access key, use the create REST API method for the AccessKey resource or the AccessKeyService/Create gRPC API call.

Examples

Add a description when creating a service account

Add a description when creating an access key.

CLI

Terraform

API

yc iam access-key create --service-account-name my-robot \
  --description "this key is for my bucket"

resource "yandex_iam_service_account_static_access_key" "sa-static-key" {
service_account_id = "<service_account_ID>"
description        = "this key is for my bucket"
pgp_key            = "BIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA+x....."
}

curl \
  --request POST \
  --header 'Content-Type: application/json' \
  --header "Authorization: Bearer <IAM_token>" \
  --data '{
      "serviceAccountId": "<service_account_ID>",
      "description": "this key is for my bucket"
  }' \
  https://iam.api.cloud.yandex.net/iam/aws-compatibility/v1/accessKeys

Creating static access keys

Examples

Add a description when creating a service account

See also

Was the article helpful?

Creating static access keys

ExamplesExamples

Add a description when creating a service accountAdd a description when creating a service account

See alsoSee also

Was the article helpful?

Examples

Add a description when creating a service account

See also