Setting up service account access permissions
This section describes how to assign roles for the service account as a resource. To assign the service account a role for another resource, follow the guide in Assigning roles to a service account.
Note
To assign a role for a service account, you need the iam.serviceAccounts.admin
role.
Assigning a role for a service account
- In the management console
, navigate to the folder the service account belongs to. - At the top of the screen, go to the Service accounts tab.
- Choose a service account and click the row with its name.
- Go to the Access bindings tab.
- Click Assign bindings.
- In the Configuring access bindings window, click Select subject.
- Select a user from the list or search by user.
- Click Add role.
- Choose the role.
- Click Save.
If you do not have the Yandex Cloud command line interface yet, install and initialize it.
The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name
or --folder-id
parameter.
-
View the description of the command to assign a role for a service account as a resource:
yc iam service-account add-access-binding --help
-
Select a service account, e.g.,
my-robot
:yc iam service-account list
Result:
+----------------------+----------+------------------+ | ID | NAME | DESCRIPTION | +----------------------+----------+------------------+ | ajebqtreob2d******** | test-sa | test-description | | aje6o61dvog2******** | my-robot | | +----------------------+----------+------------------+
-
Choose the role.
yc iam role list
Result:
+--------------------------------+-------------+ | ID | DESCRIPTION | +--------------------------------+-------------+ | admin | | | compute.images.user | | | editor | | | ... | | +--------------------------------+-------------+
-
Find out the user ID from the login or email address. To assign a role to a service account or a user group rather than to a single user, see the examples below.
yc iam user-account get test-user
Result:
id: gfei8n54hmfh******** yandex_passport_user_account: login: test-user default_email: test-user@yandex.ru
-
Assign a user named
test-user
theeditor
role for themy-robot
service account. In the subject, specify theuserAccount
type and user ID:yc iam service-account add-access-binding my-robot \ --role editor \ --subject userAccount:gfei8n54hmfh********
If you don't have Terraform, install it and configure the Yandex Cloud provider.
-
Add the resource parameters to the configuration file and specify the users' role to access the service account:
service_account_id
: ID of the service account to configure access for.role
: Role being assigned. This is a required parameter.members
: List of users or service account the role is being assigned to, specified asuserAccount:<user_ID>
orserviceAccount:<service_account_ID>
. This is a required parameter.
Here is an example of the configuration file structure:
resource "yandex_iam_service_account_iam_binding" "admin-account-iam" { service_account_id = "<service_account_ID>" role = "<role>" members = [ "federatedUser:<user_ID>", ] }
For more information about resources you can create using Terraform, see the provider documentation
. -
Make sure the configuration files are correct.
-
In the command line, go to the folder where you created the configuration file.
-
Run a check using this command:
terraform plan
If the configuration is described correctly, the terminal will display a list of created resources and their parameters. If the configuration contains any errors, Terraform will point them out.
-
-
Deploy cloud resources.
-
If the configuration does not contain any errors, run this command:
terraform apply
-
Confirm creating the resources: type
yes
in the terminal and press Enter.
All the resources you need will then be created in the specified folder. You can check the new resource using the management console
or this CLI command:yc resource-manager service-account list-access-bindings <service_account_name_or_ID>
-
Use the updateAccessBindings REST API method for the ServiceAccount resource or the ServiceAccountService/UpdateAccessBindings gRPC API call. You will need the ID of the service account and the ID of the user to whom you want to assign the role for the service account.
-
Find out the service account ID using the list REST API method:
curl -H "Authorization: Bearer <IAM_token>" \ https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts?folderId=b1gvmob95yys********
Result:
{ "serviceAccounts": [ { "id": "aje6o61dvog2********", "folderId": "b1gvmob95yys********", "createdAt": "2018-10-19T13:26:29Z", "name": "my-robot" } ... ] }
-
Find out the user ID from the login using the getByLogin REST API method:
curl -H "Authorization: Bearer <IAM_token>" \ https://iam.api.cloud.yandex.net/iam/v1/yandexPassportUserAccounts:byLogin?login=test-user
Result:
{ "id": "gfei8n54hmfh********", "yandexPassportUserAccount": { "login": "test-user", "defaultEmail": "test-user@yandex.ru" } }
-
Assign the user the
editor
role for themy-robot
service account. Set theaction
property toADD
and specify theuserAccount
type and user ID in thesubject
property:curl -X POST \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer <IAM_token>" \ -d '{ "accessBindingDeltas": [{ "action": "ADD", "accessBinding": { "roleId": "editor", "subject": { "id": "gfei8n54hmfh********", "type": "userAccount" }}}]}' \ https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/aje6o61dvog2********:updateAccessBindings
Examples
- Assigning multiple roles
- Set up impersonation
- Setting up access from one service account to another service account
Assigning multiple roles
If you do not have the Yandex Cloud command line interface yet, install and initialize it.
The add-access-binding
command allows you to add only one role. You can assign multiple roles using the set-access-binding
command.
Alert
The set-access-binding
command completely rewrites access permissions for the resource. All current resource roles will be deleted.
-
Make sure the resource has no roles assigned that you would not want to lose:
yc iam service-account list-access-bindings my-robot
-
For example, assign a role to multiple users:
yc iam service-account set-access-bindings my-robot \ --access-binding role=editor,subject=userAccount:gfei8n54hmfh******** \ --access-binding role=viewer,subject=userAccount:helj89sfj80a********
If you don't have Terraform, install it and configure the Yandex Cloud provider.
To assign several roles to a service account created with Terraform:
-
Add the resource parameters to the configuration file and specify the users' role to access the service account:
service_account_id
: ID of the service account to configure access for.role
: Role being assigned. This is a required parameter.
Note
For each role, only one
yandex_iam_service_account_iam_binding
resource can be used.members
: List of users or service account the role is being assigned to, specified asuserAccount:<user_ID>
orserviceAccount:<service_account_ID>
. This is a required parameter.
...
resource "yandex_iam_service_account_iam_binding" "admin-account-iam" {
service_account_id = "aje82upckiqh********"
role = "admin"
members = [
"userAccount:aje82upckiqh********",
]
}
resource "yandex_iam_service_account_iam_binding" "admin-account-iam2" {
service_account_id = "aje82upckiqh********"
role = "viewer"
members = [
"userAccount:aje82upckiqh********",
]
}
...
For more information about resources you can create using Terraform, see the provider documentation
-
Check the configuration using this command:
terraform validate
If the configuration is correct, you will get this message:
Success! The configuration is valid.
-
Run this command:
terraform plan
The terminal will display a list of resources with parameters. No changes will be made at this step. If the configuration contains any errors, Terraform will point them out.
-
Apply the configuration changes:
terraform apply
-
Confirm the changes: type
yes
into the terminal and press Enter.You can check the folder update using the management console
or this CLI command:yc resource-manager service-account list-access-bindings <service_account_name_or_ID>
Assign the editor
role to one user and the viewer
role to another user:
curl -X POST \
-H 'Content-Type: application/json' \
-H "Authorization: Bearer <IAM_token>" \
-d '{
"accessBindingDeltas": [{
"action": "ADD",
"accessBinding": {
"roleId": "editor",
"subject": {
"id": "gfei8n54hmfh********",
"type": "userAccount"
}
}
},{
"action": "ADD",
"accessBinding": {
"roleId": "viewer",
"subject": {
"id": "helj89sfj80a********",
"type": "userAccount"
}}}]}' \
https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/aje6o61dvog2********:updateAccessBindings
You can also assign roles using the setAccessBindings REST API method for the ServiceAccount resource or the ServiceAccountService/SetAccessBindings gRPC API call.
Alert
The setAccessBindings
method completely rewrites access permissions for the resource. All current resource roles will be deleted.
curl -X POST \
-H 'Content-Type: application/json' \
-H "Authorization: Bearer <IAM_token>" \
-d '{
"accessBindings": [{
"roleId": "editor",
"subject": { "id": "ajei8n54hmfh********", "type": "userAccount" }
},{
"roleId": "viewer",
"subject": { "id": "helj89sfj80a********", "type": "userAccount" }
}]}' \
https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/aje6o61dvog2********:setAccessBindings
Set up impersonation
Impersonation enables a user to perform actions on behalf of a service account using the --impersonate-service-account-id
flag. To do this, the service account needs the relevant permissions, and the user needs the iam.serviceAccounts.tokenCreator
role.
If you do not have the Yandex Cloud command line interface yet, install and initialize it.
-
Find out the ID of the service account that you want to assign the role to (for example,
test-sa
). To do this, get a list of available service accounts (in the administrator profile):yc iam service-account list
Result:
+----------------------+----------+------------------+ | ID | NAME | DESCRIPTION | +----------------------+----------+------------------+ | ajebqtreob2d******** | test-sa | test-description | | aje6o61dvog2******** | my-robot | | +----------------------+----------+------------------+
-
Assign the
viewer
role formy-folder
to thetest-sa
service account. In the subject type, specifyserviceAccount
, and in its value, specify the ID of the service account (in the administrator profile):yc resource-manager folder add-access-binding my-folder \ --role viewer \ --subject serviceAccount:ajebqtreob2d********
-
Retrieve the user ID and assign, to the user, the
iam.serviceAccounts.tokenCreator
role for thetest-sa
service account (in the administrator profile):yc iam service-account add-access-binding test-sa \ --role iam.serviceAccounts.tokenCreator \ --subject userAccount:gfei8n54hmfh********
-
The user can perform the command on behalf of the
test-sa
service account using the--impersonate-service-account-id
flag.For example, the user can get a list of VM instances in
my-folder
:yc compute instance list --folder-name my-folder \ --impersonate-service-account-id ajebqtreob2d********
The user can also obtain an IAM token for your
test-sa
service account, for short-term access.yc iam create-token --impersonate-service-account-id ajebqtreob2d********
The token will expire automatically.
-
If the user no longer needs this permission, revoke the role from the service account (in the administrator's profile):
yc resource-manager folder remove-access-binding my-folder \ --role viewer \ --subject serviceAccount:ajebqtreob2d********
-
Revoke the
iam.serviceAccounts.tokenCreator
role from the user you assigned the service account's privileges to:yc iam service-account remove-access-binding test-sa \ --role iam.serviceAccounts.tokenCreator \ --subject userAccount:gfei8n54hmfh********
Setting up access from one service account to another service account
Allow the test-sa
service account to manage the my-robot
service account:
If you do not have the Yandex Cloud command line interface yet, install and initialize it.
-
Find out the ID of the
test-sa
service account that you want to assign the role to. To do this, get a list of available service accounts:yc iam service-account list
Result:
+----------------------+----------+------------------+ | ID | NAME | DESCRIPTION | +----------------------+----------+------------------+ | ajebqtreob2d******** | test-sa | test-description | | aje6o61dvog2******** | my-robot | | +----------------------+----------+------------------+
-
Assign the
editor
role to thetest-sa
service account by specifying its ID. In the subject type, specifyserviceAccount
:yc iam service-account add-access-binding my-robot \ --role editor \ --subject serviceAccount:ajebqtreob2d********
If you don't have Terraform, install it and configure the Yandex Cloud provider.
To allow the test-sa
service account to manage the my-robot
service account created using Terraform:
-
Add the resource parameters to the configuration file and specify the users' role to access the service account:
service_account_id
: ID of the service account to configure access for.role
: Role being assigned. This is a required parameter.members
: List of users or service account the role is being assigned to, specified asuserAccount:<user_ID>
orserviceAccount:<service_account_ID>
. This is a required parameter.
test-sa
service account to manage the my-robot
service account using Terraform...
resource "yandex_iam_service_account_iam_binding" "admin-account-iam" {
service_account_id = "aje82upckiqh********"
role = "admin"
members = [
"serviceAccount:aje82upckiqh********",
]
}
...
For more information about resources you can create using Terraform, see the provider documentation
-
Check the configuration using this command:
terraform validate
If the configuration is correct, you will get this message:
Success! The configuration is valid.
-
Run this command:
terraform plan
The terminal will display a list of resources with parameters. No changes will be made at this step. If the configuration contains any errors, Terraform will point them out.
-
Apply the configuration changes:
terraform apply
-
Confirm the changes: type
yes
into the terminal and press Enter.You can check the folder update using the management console
or this CLI command:yc resource-manager service-account list-access-bindings <service_account_name_or_ID>
-
Find out the ID of the
test-sa
service account that you want to assign the role to. To do this, get a list of available service accounts:curl -H "Authorization: Bearer <IAM_token>" \ https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts?folderId=b1gvmob95yys********
Result:
{ "serviceAccounts": [ { "id": "ajebqtreob2d********", "folderId": "b1gvmob95yys********", "createdAt": "2018-10-18T13:42:40Z", "name": "test-sa", "description": "test-description" }, { "id": "aje6o61dvog2********", "folderId": "b1gvmob95yys********", "createdAt": "2018-10-15T18:01:25Z", "name": "my-robot" } ] }
-
Assign the
test-sa
service account theeditor
role for anothermy-robot
service account. In thesubject
property, specify theserviceAccount
type and thetest-sa
ID. In the request URL, specify themy-robot
ID as a resource:curl -X POST \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer <IAM_token>" \ -d '{ "accessBindingDeltas": [{ "action": "ADD", "accessBinding": { "roleId": "editor", "subject": { "id": "ajebqtreob2d********", "type": "serviceAccount" }}}]}' \ https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/aje6o61dvog2********:updateAccessBindings