FAQ about Identity and Access Management

General questionsGeneral questions

What do I need Yandex Identity and Access Management for?What do I need Yandex Identity and Access Management for?

The IAM service controls access to resources and lets you configure access rights. You determine who should have rights for a certain resource and what these rights are, while IAM grants access according to the assigned rights.

IAM enables you to:

• Manage access permissions for resources by assigning and revoking roles.
• Create service accounts. These are special accounts used for managing Yandex Cloud resources via the API.
• Get an IAM token for API authentication.

Other Yandex Cloud services use the IAM API to give you more options for managing access to their resources. For example, Yandex Compute Cloud additionally provides the compute.images.user role to manage access to disk images.

How do I get started with IAM?How do I get started with IAM?

To get started with IAM, you need to register with Yandex Cloud. Once registered, you will be able to use the IAM features.

How much does it cost to use IAM?How much does it cost to use IAM?

Using IAM is free of charge.

Can I get logs of my operations in Yandex Cloud?Can I get logs of my operations in Yandex Cloud?

Yes, you can request information about operations with your resources from Yandex Cloud logs. Do it by contacting support.

Logging in and accessing resourcesLogging in and accessing resources

How do I log in to the management console?How do I log in to the management console?

Go to the management console page.

If not logged in to your Yandex or Yandex 360 account yet, click Log in. If you do not have an account yet, click Register. For more information, see (https://yandex.com/support/passport/auth.html).

How do I grant a user access to the management console and a folder?How do I grant a user access to the management console and a folder?

To grant access to the management console, assign the user the resource-manager.clouds.member role for the cloud. Assign resource access permissions for the specific folder or resource. Here is an example:

• A user holding the resource-manager.clouds.member role for a cloud and compute.editor for a folder can work with Compute Cloud resources in that folder via the management console.
• A user holding the resource-manager.clouds.member role for a cloud and resource-manager.viewer for a folder can view information about the folder and access permissions assigned for it.

If a user already has the admin role for a folder but cannot see the folder in the console, check their cloud access role. Assigning the admin role for the entire cloud is excessive, as this role grants permissions for all folders and resources in that cloud.

For other roles that provide console access, see Cloud member. For information on how to assign roles, see this guide.

What do I do if I get the error when trying to get an IAM token?What do I do if I get the User has to accept the End User License Agreement error when trying to get an IAM token?

When getting an IAM token via the Yandex Cloud CLI, Terraform, or a direct request to the API, you may get one of these errors:

• User has to accept the End User License Agreement to get an IAM token
• User has to accept the End User License Agreement and Privacy Policy to get an IAM token

The error means that the user requesting the IAM token has not accepted the required agreements yet.

To solve the error, log in to the user’s account and accept the license agreement and privacy policy on the agreement acceptance page. Then try to get the IAM token again.

If instead of the agreement acceptance page you see a folder in the management console, log out of the account and then log back in. You can also try opening the link in incognito mode or in another browser.

If the agreements are already accepted, make sure the token in the CLI profile, Terraform provider settings, or the API request belongs to the same user. For an OAuth token, you can figure out the owner by requesting user info: the login field of the response will contain the Yandex account login.

To work in the CLI as a federated or local user, configure authentication appropriately:

• Authenticating with the Yandex Cloud CLI as a federated user
• Authenticating in the Yandex Cloud CLI as a local user

How are access permissions verified?How are access permissions verified?

Before performing an operation with a resource, such as creating a VM, IAM checks whether the user has all the required permissions. If any of the required permissions are missing, the operation will fail and Yandex Cloud will report an error. For more information, see How access management works in Yandex Cloud.

What is a resource?What is a resource?

A resource is a Yandex Cloud entity you can manage through operations, such as creating, updating, viewing, or deleting. Here are some examples of resources: VMs, disks, service accounts, clouds, and folders. For more information, see Yandex Cloud resource hierarchy in the Resource Manager guides.

How do I change the cloud owner?How do I change the cloud owner?

1. Add the new owner to the organization if they are not already a member.
2. On behalf of the current owner, assign the user the resource-manager.clouds.owner role for the cloud.
3. Check the new owner’s access. Then revoke the resource-manager.clouds.owner role from the previous owner. Optionally, assign them other roles in accordance with their responsibilities.

A cloud must have at least one owner. Changing the organization owner is a separate operation.

If facing any issues when trying to change the owner, contact support. Specify the cloud and organization IDs and the usernames of the former and new owners.

How do I change the organization owner?How do I change the organization owner?

On behalf of the current owner, assign the organization-manager.organizations.owner role to the new owner. The new owner must be the organization member.

After verifying the new owner’s access, revoke this role from the previous owner. Do not remove the previous owner from the organization unless they no longer need access.

If facing any issues when trying to perform these actions, contact support. Specify the organization ID and the usernames of the former and new owners.

TroubleshootingTroubleshooting

Why do I get the or error when working under the service account?Why do I get the 403 Forbidden or Permission Denied error when working under the service account?

Make sure the service account has roles for the resource it works with or for the parent folder or cloud. A role for the service account itself as a resource does not grant access to virtual machines, buckets, or other resources.

Assign the necessary roles to the service account as detailed in Assigning a role to a service account.

What should I do if I get the error?What should I do if I get the Service account is not available error?

You may encounter this error when working through the console, CLI, API, or other tools if the requesting account has no permissions to use the selected service account.

Assign to that account the iam.serviceAccounts.user role for the service account in question by following this guide. You can also assign the role for the parent folder or cloud.

If you are sending the request using the same service account you are associating with the resource, that service account also needs permissions to use itself. For example, these permissions are checked when creating a container revision in Serverless Containers.

Why cannot I assign the cloud owner role?Why cannot I assign the cloud owner role?

The Role 'resource-manager.clouds.owner' is only applicable to resources of type 'resource-manager.cloud' error means that you are assigning the role for a resource of a different type, e.g., a folder or organization.

You can assign the resource-manager.clouds.owner role only for a cloud. In the access permission section, select the cloud and assign the role by following this guide. Only the cloud owner can assign this role.

What should I do if I get an error when sending or accepting an invitation to an organization?What should I do if I get an error when sending or accepting an invitation to an organization?

Your actions depend on the error message:

• No valid emails. Or all specified emails have been invited before: Check the email addresses and whether the users are already in the organization or the list of invitees.
• Invitation ... has 'ACCEPTED' status. Expected status 'PENDING': Invitation has already been accepted. Log in to the organization using the account that was selected when accepting the invitation. It does not have to be accepted again.
• Invitation ... has been expired after ...: Invitation has expired. Ask the administrator to resend the invitation.
• Permission denied: Check which account is used to perform the action. To send invitations, the user needs the necessary roles. If the error occurs when accepting the invitation, report its details to the organization administrator or support.

If you see Contact the organization administrator for a new invitation, open the error details and check the invitation status. The administrator can delete the invitation or resend it.

If the issue persists, contact support. Attach the full error message and the HAR file captured when reproducing the error.

Why is the federated user missing from the organization?Why is the federated user missing from the organization?

If a user is on the list of federated users but not on the list of organization users, they may have been deleted from the organization.

Add the user to the federation again. Use their Name ID on the identity provider's side: this ID may not be matching their email address.

After you add the user again, their user ID in the organization will change. Check the new account’s access permissions and reassign the necessary roles.

Why are the user’s name and email address not shown in the organization?Why are the user’s name and email address not shown in the organization?

The original account may have been deleted on the Yandex 360 or identity provider's side. Check this with the administrator and, if the account is no longer used, delete the user from the organization.

How to fix the error?How to fix the The signature of response or assertion was invalid error?

Check the certificate your identity provider uses to sign SAML responses. If the certificate was updated on the provider's side, add the current certificate to the federation.

For automated updates, use the CLI or API as per this guide. Make sure you use a SAML federation certificate, not an authorization key of the service account.

How to fix the error?How to fix the Response is invalid in a general way error?

The Response is invalid in a general way or The assertion was not valid error means that the identity provider’s SAML response failed validation.

1. Make sure the provider's settings specify your federation’s ACS URL.
2. Check the SAML response signing settings and certificate as per the recommendations for signature errors.
3. Check the settings against the guide for your identity provider.
4. After you update the settings, try logging in again.

If the error persists, contact support. Attach the full error message, name and version of your identity provider, screenshots of the SAML settings, and the HAR file captured when reproducing the error. Remove cookies, tokens, and personal data from the HAR file before you send it.