Contact UsGet started
© 2024 Iron Hive LLC Belgrade
Yandex Identity and Access Management

Setting up service account access permissions

Written by
Updated at July 24, 2024

This section describes how to assign roles for the service account as a resource. To assign the service account a role for another resource, follow the guide in Assigning roles to a service account.

Note

To assign a role for a service account, you need the iam.serviceAccounts.admin role.

Assigning a role for a service account

  1. In the management console, navigate to the folder the service account belongs to.
  2. At the top of the screen, go to the Service accounts tab.
  3. Choose a service account and click the row with its name.
  4. Go to the Access bindings tab.
  5. Click Assign bindings.
  6. In the Configuring access bindings window, click Select subject.
  7. Select a user from the list or search by user.
  8. Click Add role.
  9. Choose the role.
  10. Click Save.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

  1. View the description of the command to assign a role for a service account as a resource:

    yc iam service-account add-access-binding --help

  2. Select a service account, e.g., my-robot:

    yc iam service-account list

    Result:

    +----------------------+----------+------------------+
|          ID          |   NAME   |   DESCRIPTION    |
+----------------------+----------+------------------+
| ajebqtreob2d******** | test-sa  | test-description |
| aje6o61dvog2******** | my-robot |                  |
+----------------------+----------+------------------+

  3. Choose the role.

    yc iam role list

    Result:

    +--------------------------------+-------------+
|               ID               | DESCRIPTION |
+--------------------------------+-------------+
| admin                          |             |
| compute.images.user            |             |
| editor                         |             |
| ...                            |             |
+--------------------------------+-------------+

  4. Find out the user ID from the login or email address. To assign a role to a service account or a user group rather than to a single user, see the examples below.

    yc iam user-account get test-user

    Result:

    id: gfei8n54hmfh********
yandex_passport_user_account:
    login: test-user
    default_email: test-user@yandex.ru

  5. Assign a user named test-user the editor role for the my-robot service account. In the subject, specify the userAccount type and user ID:

    yc iam service-account add-access-binding my-robot \
  --role editor \
  --subject userAccount:gfei8n54hmfh********

If you don't have Terraform, install it and configure the Yandex Cloud provider.

  1. Add the resource parameters to the configuration file and specify the users' role to access the service account:

    • service_account_id: ID of the service account to configure access for.
    • role: Role being assigned. This is a required parameter.
    • members: List of users or service account the role is being assigned to, specified as userAccount:<user_ID> or serviceAccount:<service_account_ID>. This is a required parameter.

    Here is an example of the configuration file structure:

    resource "yandex_iam_service_account_iam_binding" "admin-account-iam" {
  service_account_id = "<service_account_ID>"
  role               = "<role>"
  members            = [
    "federatedUser:<user_ID>",
  ]
}

    For more information about resources you can create using Terraform, see the provider documentation.

  2. Make sure the configuration files are correct.

    1. In the command line, go to the folder where you created the configuration file.

    2. Run a check using this command:

      terraform plan

    If the configuration is described correctly, the terminal will display a list of created resources and their parameters. If the configuration contains any errors, Terraform will point them out.

  3. Deploy cloud resources.

    1. If the configuration does not contain any errors, run this command:

      terraform apply

    2. Confirm creating the resources: type yes in the terminal and press Enter.

    All the resources you need will then be created in the specified folder. You can check the new resource using the management console or this CLI command:

    yc resource-manager service-account list-access-bindings <service_account_name_or_ID>

Use the updateAccessBindings REST API method for the ServiceAccount resource or the ServiceAccountService/UpdateAccessBindings gRPC API call. You will need the ID of the service account and the ID of the user to whom you want to assign the role for the service account.

  1. Find out the service account ID using the list REST API method:

    curl -H "Authorization: Bearer <IAM_token>" \
  https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts?folderId=b1gvmob95yys********

    Result:

    {
"serviceAccounts": [
    {
    "id": "aje6o61dvog2********",
    "folderId": "b1gvmob95yys********",
    "createdAt": "2018-10-19T13:26:29Z",
    "name": "my-robot"
    }
    ...
]
}

  2. Find out the user ID from the login using the getByLogin REST API method:

    curl -H "Authorization: Bearer <IAM_token>" \
  https://iam.api.cloud.yandex.net/iam/v1/yandexPassportUserAccounts:byLogin?login=test-user

    Result:

    {
"id": "gfei8n54hmfh********",
"yandexPassportUserAccount": {
    "login": "test-user",
    "defaultEmail": "test-user@yandex.ru"
}
}

  3. Assign the user the editor role for the my-robot service account. Set the action property to ADD and specify the userAccount type and user ID in the subject property:

    curl -X POST \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer <IAM_token>" \
  -d '{
  "accessBindingDeltas": [{
      "action": "ADD",
      "accessBinding": {
          "roleId": "editor",
          "subject": {
              "id": "gfei8n54hmfh********",
              "type": "userAccount"
  }}}]}' \
  https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/aje6o61dvog2********:updateAccessBindings

Examples

Assigning multiple roles

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

The add-access-binding command allows you to add only one role. You can assign multiple roles using the set-access-binding command.

Alert

The set-access-binding command completely rewrites access permissions for the resource. All current resource roles will be deleted.

  1. Make sure the resource has no roles assigned that you would not want to lose:

    yc iam service-account list-access-bindings my-robot

  2. For example, assign a role to multiple users:

    yc iam service-account set-access-bindings my-robot \
  --access-binding role=editor,subject=userAccount:gfei8n54hmfh******** \
  --access-binding role=viewer,subject=userAccount:helj89sfj80a********

If you don't have Terraform, install it and configure the Yandex Cloud provider.

To assign several roles to a service account created with Terraform:

  1. Add the resource parameters to the configuration file and specify the users' role to access the service account:

    • service_account_id: ID of the service account to configure access for.
    • role: Role being assigned. This is a required parameter.

    Note

    For each role, only one yandex_iam_service_account_iam_binding resource can be used.

    • members: List of users or service account the role is being assigned to, specified as userAccount:<user_ID> or serviceAccount:<service_account_ID>. This is a required parameter.
Example of assigning multiple roles to a service account using Terraform
...
resource "yandex_iam_service_account_iam_binding" "admin-account-iam" {
  service_account_id = "aje82upckiqh********"
  role               = "admin"
  members = [
    "userAccount:aje82upckiqh********",
  ]
}
resource "yandex_iam_service_account_iam_binding" "admin-account-iam2" {
  service_account_id = "aje82upckiqh********"
  role               = "viewer"
  members = [
    "userAccount:aje82upckiqh********",
  ]
}
...

For more information about resources you can create using Terraform, see the provider documentation.

  1. Check the configuration using this command:

    terraform validate

    If the configuration is correct, you will get this message:

    Success! The configuration is valid.

  2. Run this command:

    terraform plan

    The terminal will display a list of resources with parameters. No changes will be made at this step. If the configuration contains any errors, Terraform will point them out.

  3. Apply the configuration changes:

    terraform apply

  4. Confirm the changes: type yes into the terminal and press Enter.

    You can check the folder update using the management console or this CLI command:

    yc resource-manager service-account list-access-bindings <service_account_name_or_ID>

Assign the editor role to one user and the viewer role to another user:

curl -X POST \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer <IAM_token>" \
    -d '{
    "accessBindingDeltas": [{
        "action": "ADD",
        "accessBinding": {
            "roleId": "editor",
            "subject": {
                "id": "gfei8n54hmfh********",
                "type": "userAccount"
            }
        }
    },{
        "action": "ADD",
        "accessBinding": {
            "roleId": "viewer",
            "subject": {
                "id": "helj89sfj80a********",
                "type": "userAccount"
    }}}]}' \
    https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/aje6o61dvog2********:updateAccessBindings

You can also assign roles using the setAccessBindings REST API method for the ServiceAccount resource or the ServiceAccountService/SetAccessBindings gRPC API call.

Alert

The setAccessBindings method completely rewrites access permissions for the resource. All current resource roles will be deleted.

curl -X POST \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer <IAM_token>" \
    -d '{
    "accessBindings": [{
        "roleId": "editor",
        "subject": { "id": "ajei8n54hmfh********", "type": "userAccount" }
    },{
        "roleId": "viewer",
        "subject": { "id": "helj89sfj80a********", "type": "userAccount" }
    }]}' \
    https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/aje6o61dvog2********:setAccessBindings

Set up impersonation

Impersonation enables a user to perform actions on behalf of a service account using the --impersonate-service-account-id flag. To do this, the service account needs the relevant permissions, and the user needs the iam.serviceAccounts.tokenCreator role.

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

  1. Find out the ID of the service account that you want to assign the role to (for example, test-sa). To do this, get a list of available service accounts (in the administrator profile):

    yc iam service-account list

    Result:

    +----------------------+----------+------------------+
|          ID          |   NAME   |   DESCRIPTION    |
+----------------------+----------+------------------+
| ajebqtreob2d******** | test-sa  | test-description |
| aje6o61dvog2******** | my-robot |                  |
+----------------------+----------+------------------+

  2. Assign the viewer role for my-folder to the test-sa service account. In the subject type, specify serviceAccount, and in its value, specify the ID of the service account (in the administrator profile):

    yc resource-manager folder add-access-binding my-folder \
  --role viewer \
  --subject serviceAccount:ajebqtreob2d********

  3. Retrieve the user ID and assign, to the user, the iam.serviceAccounts.tokenCreator role for the test-sa service account (in the administrator profile):

    yc iam service-account add-access-binding test-sa \
  --role iam.serviceAccounts.tokenCreator \
  --subject userAccount:gfei8n54hmfh********

  4. The user can perform the command on behalf of the test-sa service account using the --impersonate-service-account-id flag.

    For example, the user can get a list of VM instances in my-folder:

    yc compute instance list --folder-name my-folder \
  --impersonate-service-account-id ajebqtreob2d********

    The user can also obtain an IAM token for your test-sa service account, for short-term access.

    yc iam create-token --impersonate-service-account-id ajebqtreob2d********

    The token will expire automatically.

  5. If the user no longer needs this permission, revoke the role from the service account (in the administrator's profile):

    yc resource-manager folder remove-access-binding my-folder \
  --role viewer \
  --subject serviceAccount:ajebqtreob2d********

  6. Revoke the iam.serviceAccounts.tokenCreator role from the user you assigned the service account's privileges to:

    yc iam service-account remove-access-binding test-sa \
  --role iam.serviceAccounts.tokenCreator \
  --subject userAccount:gfei8n54hmfh********

Setting up access from one service account to another service account

Allow the test-sa service account to manage the my-robot service account:

If you do not have the Yandex Cloud command line interface yet, install and initialize it.

  1. Find out the ID of the test-sa service account that you want to assign the role to. To do this, get a list of available service accounts:

    yc iam service-account list

    Result:

    +----------------------+----------+------------------+
|          ID          |   NAME   |   DESCRIPTION    |
+----------------------+----------+------------------+
| ajebqtreob2d******** | test-sa  | test-description |
| aje6o61dvog2******** | my-robot |                  |
+----------------------+----------+------------------+

  2. Assign the editor role to the test-sa service account by specifying its ID. In the subject type, specify serviceAccount:

    yc iam service-account add-access-binding my-robot \
  --role editor \
  --subject serviceAccount:ajebqtreob2d********

If you don't have Terraform, install it and configure the Yandex Cloud provider.

To allow the test-sa service account to manage the my-robot service account created using Terraform:

  1. Add the resource parameters to the configuration file and specify the users' role to access the service account:

    • service_account_id: ID of the service account to configure access for.
    • role: Role being assigned. This is a required parameter.
    • members: List of users or service account the role is being assigned to, specified as userAccount:<user_ID> or serviceAccount:<service_account_ID>. This is a required parameter.
Example of allowing the test-sa service account to manage the my-robot service account using Terraform
...
resource "yandex_iam_service_account_iam_binding" "admin-account-iam" {
  service_account_id = "aje82upckiqh********"
  role               = "admin"
  members = [
    "serviceAccount:aje82upckiqh********",
  ]
}
...

For more information about resources you can create using Terraform, see the provider documentation.

  1. Check the configuration using this command:

    terraform validate

    If the configuration is correct, you will get this message:

    Success! The configuration is valid.

  2. Run this command:

    terraform plan

    The terminal will display a list of resources with parameters. No changes will be made at this step. If the configuration contains any errors, Terraform will point them out.

  3. Apply the configuration changes:

    terraform apply

  4. Confirm the changes: type yes into the terminal and press Enter.

    You can check the folder update using the management console or this CLI command:

    yc resource-manager service-account list-access-bindings <service_account_name_or_ID>

  1. Find out the ID of the test-sa service account that you want to assign the role to. To do this, get a list of available service accounts:

    curl -H "Authorization: Bearer <IAM_token>" \
  https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts?folderId=b1gvmob95yys********

    Result:

    {
 "serviceAccounts": [
  {
   "id": "ajebqtreob2d********",
   "folderId": "b1gvmob95yys********",
   "createdAt": "2018-10-18T13:42:40Z",
   "name": "test-sa",
   "description": "test-description"
  },
  {
   "id": "aje6o61dvog2********",
   "folderId": "b1gvmob95yys********",
   "createdAt": "2018-10-15T18:01:25Z",
   "name": "my-robot"
  }
 ]
}

  2. Assign the test-sa service account the editor role for another my-robot service account. In the subject property, specify the serviceAccount type and the test-sa ID. In the request URL, specify the my-robot ID as a resource:

    curl -X POST \
    -H 'Content-Type: application/json' \
    -H "Authorization: Bearer <IAM_token>" \
    -d '{
    "accessBindingDeltas": [{
        "action": "ADD",
        "accessBinding": {
            "roleId": "editor",
            "subject": {
                "id": "ajebqtreob2d********",
                "type": "serviceAccount"
    }}}]}' \
    https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts/aje6o61dvog2********:updateAccessBindings
Previous
Assigning roles to a service account
Next
Getting service account ID
© 2024 Iron Hive LLC Belgrade
In this article: