Setting up service account access permissions

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

1. View the description of the command for assigning a role for a service account as a resource:

   yc iam service-account add-access-binding --help
   

2. Get the role ID:

   yc iam role list
   

   Result:

   +-------------------------------------+-------------+
   |                 ID                  | DESCRIPTION |
   +-------------------------------------+-------------+
   | access-transparency.admin           |             |
   | access-transparency.billingProvider |             |
   | access-transparency.editor          |             |
   | ...                                 |             |
   

3. Assign a role for a service account to the subject:

   yc iam service-account add-access-binding <service_account_name_or_ID> \
     --role <role_ID> \
     --subject <subject_type>:<subject_ID>
   

   Where:

   • --role: ID of the role to assign.

   • --subject: Subject getting the role.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and matching CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. Describe the resource with the role for the organization in the configuration file.

   Configuration file structure example:

   resource "yandex_iam_service_account_iam_binding" "admin-account-iam" {
     service_account_id = "<service_account_ID>"
     role               = "<role>"
     members            = ["<subject_1_type>:<subject_1_ID>",
                           "<subject_2_type>:<subject_2_ID>",
                           ...,
                           "<subject_n_type>:<subject_n_ID>"]
   }
   

   Where:

   • service_account_id: ID of the service account to configure access for.

   • role: Role.

   • members: Designations of subjects the role is assigned to.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. Here is how you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more information about the resources you can create with Terraform, see this provider guide.

2. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

3. Assign the role.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

   This will create all the resources you need in the specified folder. You can check the new resource using the management console or this CLI command:

   yc resource-manager service-account list-access-bindings <service_account_name_or_ID>
   

Use the updateAccessBindings REST API method for the ServiceAccount resource or the ServiceAccountService/UpdateAccessBindings gRPC API call. You will need the ID of the service account and that of the subject getting the role for the service account.

1. Get the service account ID using the list REST API method:

   curl \
     --header "Authorization: Bearer <IAM_token>" \
     https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts?folderId=<folder_ID>
   

   Result:

   {
   "serviceAccounts": [
       {
       "id": "aje6o61dvog2********",
       "folderId": "b1gvmob95yys********",
       "createdAt": "2018-10-19T13:26:29Z",
       "name": "my-robot"
       }
       ...
   ]
   }
   

2. Assign a role for a service account to the subject; specify ADD in the action property:

   curl \
     --request POST \
     --header 'Content-Type: application/json' \
     --header "Authorization: Bearer <IAM_token>" \
     --data '{
     "accessBindingDeltas": [{
         "action": "ADD",
         "accessBinding": {
             "roleId": "<role>",
             "subject": {
                 "id": "<subject_ID>",
                 "type": "<subject_type>"
     }}}]}' \
     https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/<service_account_ID>:updateAccessBindings
   

   Where:

   • roleId: Role.

   • subject: Subject getting the role.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

     subject.type	subject.id
     userAccount	<user_ID>
     serviceAccount	<service_account_ID>
     federatedUser	<user_ID>
     group	<group_ID>
     system	allAuthenticatedUsers (All authenticated users group)
     	allUsers (All users group)
     	group:organization:<organization_ID>:users (All users in organization X group)
     	group:federation:<federation_ID>:users (All users in federation N group)
     	group:userpool:<pool_ID>:users (All users in userpool P group)

   • <service_account_ID>: ID of the service account to configure access for.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

Assign the editor role for the my-robot service account to test-user:

```bash
yc iam service-account add-access-binding my-robot \
  --role editor \
  --user-yandex-login test-user
```

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. Add the resource parameters to the configuration file and specify the users' role to access the service account.

   Configuration file structure example:

   resource "yandex_iam_service_account_iam_binding" "admin-account-iam" {
     service_account_id = "aje6o61dvog2********"
     role               = "editor"
     members            = ["userAccount:gfei8n54hmfh********",]
   }
   

   Where:

   • service_account_id: ID of the service account to configure access for.
   • role: Role.
   • members: List of users getting the role. Use this format: userAccount:<user_ID>.

   For more information about the resources you can create with Terraform, see this provider guide.

2. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

3. Assign the role.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

   This will create all the resources you need in the specified folder. You can check the new resource using the management console or this CLI command:

   yc resource-manager service-account list-access-bindings <service_account_name_or_ID>
   

Use the updateAccessBindings REST API method for the ServiceAccount resource or the ServiceAccountService/UpdateAccessBindings gRPC API call. You will need the ID of the service account and that of the user getting the role for the service account.

1. Find out the service account ID using the list REST API method:

   curl \
     --header "Authorization: Bearer <IAM_token>" \
     https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts?folderId=b1gvmob95yys********
   

   Result:

   {
   "serviceAccounts": [
       {
       "id": "aje6o61dvog2********",
       "folderId": "b1gvmob95yys********",
       "createdAt": "2018-10-19T13:26:29Z",
       "name": "my-robot"
       }
       ...
   ]
   }
   

2. Get the user ID by login using the getByLogin REST API method:

   curl \
     --header "Authorization: Bearer <IAM_token>" \
     https://iam.api.cloud.yandex.net/iam/v1/yandexPassportUserAccounts:byLogin?login=test-user
   

   Result:

   {
   "id": "gfei8n54hmfh********",
   "yandexPassportUserAccount": {
       "login": "test-user",
       "defaultEmail": "test-user@yandex.ru"
   }
   }
   

3. Assign the editor role for the my-robot service account. Enter ADD in the action property and specify the userAccount type and user ID under subject.

   curl \
     --request POST \
     --header 'Content-Type: application/json' \
     --header "Authorization: Bearer <IAM_token>" \
     --data '{
     "accessBindingDeltas": [{
         "action": "ADD",
         "accessBinding": {
             "roleId": "editor",
             "subject": {
                 "id": "gfei8n54hmfh********",
                 "type": "userAccount"
     }}}]}' \
     https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/aje6o61dvog2********:updateAccessBindings
   

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

To assign multiple roles for a service account created with Terraform:

1. Add the resource parameters to the configuration file and specify the users' role to access the service account:

   • service_account_id: ID of the service account to configure access for.

   • role: Role.

     Note

     For each role, you can only use one yandex_iam_service_account_iam_binding resource.

   • members: List of users or service accounts getting the role. Use one of these formats: userAccount:<user_ID> or serviceAccount:<service_account_ID>.

   Example of assigning multiple roles for a service account using Terraform

   ...
   resource "yandex_iam_service_account_iam_binding" "admin-account-iam" {
     service_account_id = "aje82upckiqh********"
     role               = "admin"
     members = [
       "userAccount:aje82upckiqh********",
     ]
   }
   resource "yandex_iam_service_account_iam_binding" "admin-account-iam2" {
     service_account_id = "aje82upckiqh********"
     role               = "viewer"
     members = [
       "userAccount:aje82upckiqh********",
     ]
   }
   ...
   

   For more information about the resources you can create with Terraform, see this provider guide.

2. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

3. Assign the role.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

   You can check the folder update using the management console or this CLI command:

   yc resource-manager service-account list-access-bindings <service_account_name_or_ID>
   

Assign the editor role to one user and the viewer role to another user:

curl \
  --request POST \
  --header 'Content-Type: application/json' \
  --header "Authorization: Bearer <IAM_token>" \
  --data '{
  "accessBindingDeltas": [{
      "action": "ADD",
      "accessBinding": {
          "roleId": "editor",
          "subject": {
              "id": "gfei8n54hmfh********",
              "type": "userAccount"
          }
      }
  },{
      "action": "ADD",
      "accessBinding": {
          "roleId": "viewer",
          "subject": {
              "id": "helj89sfj80a********",
              "type": "userAccount"
  }}}]}' \
  https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/aje6o61dvog2********:updateAccessBindings

You can also assign roles using the setAccessBindings REST API method for the ServiceAccount resource or the ServiceAccountService/SetAccessBindings gRPC API call.

curl \
  --request POST \
  --header 'Content-Type: application/json' \
  --header "Authorization: Bearer <IAM_token>" \
  --data '{
  "accessBindings": [{
      "roleId": "editor",
      "subject": { "id": "ajei8n54hmfh********", "type": "userAccount" }
  },{
      "roleId": "viewer",
      "subject": { "id": "helj89sfj80a********", "type": "userAccount" }
  }]}' \
  https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/aje6o61dvog2********:setAccessBindings

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

To allow the test-sa service account to manage the my-robot service account created with Terraform:

1. Add the resource parameters to the configuration file and specify the users' role to access the service account:

   • service_account_id: ID of the service account to configure access for.
   • role: Role.
   • members: List of users or service accounts getting the role. Use one of these formats: userAccount:<user_ID> or serviceAccount:<service_account_ID>.
   Example of granting permissions to the test-sa service account to manage the my-robot service account using Terraform

   ...
   resource "yandex_iam_service_account_iam_binding" "admin-account-iam" {
     service_account_id = "aje82upckiqh********"
     role               = "admin"
     members = [
       "serviceAccount:aje82upckiqh********",
     ]
   }
   ...
   

   For more information about the resources you can create with Terraform, see this provider guide.

2. Make sure the settings are correct.

   1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

   2. Run this command:

      terraform validate
      

      Terraform will show any errors found in your configuration files.

3. Assign the role.

   1. Run this command to view the planned changes:

      terraform plan
      

      If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

   2. If everything looks correct, apply the changes:

      1. Run this command:

         terraform apply
         

      2. Confirm updating the resources.

      3. Wait for the operation to complete.

   You can check the folder update using the management console or this CLI command:

   yc resource-manager service-account list-access-bindings <service_account_name_or_ID>
   

1. Get the ID of the test-sa service account you want to assign a role to. To do this, get a list of available service accounts:

   curl \
     --header "Authorization: Bearer <IAM_token>" \
     https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts?folderId=b1gvmob95yys********
   

   Result:

   {
    "serviceAccounts": [
     {
      "id": "ajebqtreob2d********",
      "folderId": "b1gvmob95yys********",
      "createdAt": "2018-10-18T13:42:40Z",
      "name": "test-sa",
      "description": "test-description"
     },
     {
      "id": "aje6o61dvog2********",
      "folderId": "b1gvmob95yys********",
      "createdAt": "2018-10-15T18:01:25Z",
      "name": "my-robot"
     }
    ]
   }
   

2. Assign the editor role to the test-sa service account for another service account named my-robot. In the subject property, specify the serviceAccount type and test-sa ID. In the request URL, specify the my-robot ID as the resource:

   curl \
     --request POST \
     --header 'Content-Type: application/json' \
     --header "Authorization: Bearer <IAM_token>" \
     --data '{
     "accessBindingDeltas": [{
         "action": "ADD",
         "accessBinding": {
             "roleId": "editor",
             "subject": {
                 "id": "ajebqtreob2d********",
                 "type": "serviceAccount"
     }}}]}' \
     https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/aje6o61dvog2********:updateAccessBindings