Suspending and reactivating a service account
To suspend or reactivate a service account, you must have the editor role for the service account or at least the iam.serviceAccounts.admin role for the parent folder.
Suspending a service account
Suspend a service account to pause its activity in Yandex Cloud. All its roles are retained, but become inactive until you restore the account.
If you do not have the Yandex Cloud CLI yet, install and initialize it.
The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.
If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
-
See the description of the command for suspending a service account:
yc iam service-account suspend --help -
Get a list of service accounts in the default folder:
yc iam service-account listResult:
+----------------------+------------------+-------------------------------+ | ID | NAME | DESCRIPTION | +----------------------+------------------+-------------------------------+ | aje6o61dvog2******** | my-robot | | | aje9sda1ufvq******** | account_name | account_description | +----------------------+------------------+-------------------------------+ -
Suspend the service account by specifying its name or ID:
yc iam service-account suspend <account_name_or_ID>Here is an example:
yc iam service-account suspend my-robot
To suspend a service account, use the suspend REST API method for the ServiceAccount resource or the ServiceAccountService/Suspend gRPC API call.
Reactivating a service account
To restore service account activity in Yandex Cloud, reactivate it.
If the account was suspended due to expired lifetime (--expires-at), set a new lifetime for the service account or run the reactivate command as described below.
Warning
The reactivate command will reactivate the account, but it does not affect the expires-at setting. You account will be suspended again unless you update its lifetime.
If you do not have the Yandex Cloud CLI yet, install and initialize it.
The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.
If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
-
See the description of the service account reactivation command:
yc iam service-account reactivate --help -
Get a list of service accounts in the default folder:
yc iam service-account listResult:
+----------------------+------------------+-------------------------------+ | ID | NAME | DESCRIPTION | +----------------------+------------------+-------------------------------+ | aje6o61dvog2******** | my-robot | | | aje9sda1ufvq******** | account_name | account_description | +----------------------+------------------+-------------------------------+ -
Reactivate the service account by specifying its name or ID:
yc iam service-account reactivate <account_name_or_ID>Here is an example:
yc iam service-account reactivate my-robot
To reactivate a service account, use the reactivate REST API method for the ServiceAccount resource or the ServiceAccountService/Reactivate gRPC API call.