Getting started with service accounts

In IAM, you can create service accounts. These are auxiliary accounts that your programs can use to perform operations in Yandex Cloud. Service accounts are free of charge. They allow you to flexibly manage access for your programs. For more information, see Service accounts.

This guide is intended for cloud owners and users with the administrator role for a cloud or folder. Users with the editor role can also create service accounts, but they cannot assign roles, so they cannot allow a service account to perform operations in Yandex Cloud.

Checking for required roles is described in Getting started.

You will learn how to:

• Create service accounts and assign roles to them.
• Run operations in the CLI.
• Delete service accounts.

Getting startedGetting started

1. Log in to the management console. If not registered yet, navigate to the management console and follow the guide.

2. Make sure that you have the required roles:

   1. In the management console, select the appropriate cloud from the list on the left. For example:

      

   2. Go to the Access bindings tab.

   3. Specify your account in the search bar.

   4. Check that your account has the following roles:

      • Organization owner (organization-manager.organizations.owner) or administrator (organization-manager.admin).
      • Cloud owner (resource-manager.clouds.owner) or administrator (admin).

3. On the Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account yet, create one.

Create a service accountCreate a service account

To create a service account and assign roles to it:

1. Log in to the management console.

2. Click the line with the name of the folder where you want to create a service account.

3. At the top of the screen, go to the Service accounts tab.

4. Click Create service account.

5. Enter the name of the service account.

   The name format requirements are as follows:

   • The name must be from 3 to 63 characters long.
   • It may contain lowercase Latin letters, numbers, and hyphens.
   • The first character must be a letter and the last character cannot be a hyphen.

   Make sure the service account name is unique within your cloud.

6. To assign the service account a role for the current folder, click Add role and select a role such as editor.

   To assign a role for another resource, use the CLI or API by following the instructions Assigning roles to a service account.

7. Click Create.

Configure the CLI to work on behalf of a service accountConfigure the CLI to work on behalf of a service account

You can perform operations on behalf of a service account via the API, CLI, and other tools that support service account based authentication. You cannot log in to the management console using a service account.

Configure the CLI to work on behalf of a service account:

1. If you do not have the Yandex Cloud command line interface yet, install and initialize it.

2. Create an authorized key for your service account and save the file:

   yc iam key create --service-account-name my-robot --output key.json
   

   If you see ERROR: service account with name "my-robot" not found, it means there is no service account with this name in the default folder. If the name is correct, run one of the following commands:

   • Specify the folder with the service account using the --folder-name or --folder-id parameter:

     yc iam key create --folder-name my-folder --service-account-name my-robot --output key.json
     

   • Specify the service account ID using the --service-account-id parameter:

     yc iam key create --service-account-id b1gnbfd11bq5******** --output key.json
     

3. Create a profile to execute operations on behalf of the service account:

   yc config profile create my-robot-profile
   

4. Specify the authorized key of the service account in the profile configuration:

   yc config set service-account-key key.json
   

Now you can perform operations on behalf of a service account, such as viewing the list of folders available to this account:

yc resource-manager folder list

Delete the service accountDelete the service account

If you no longer need the service account, delete it:

1. In the management console, select the folder the service account belongs to.
2. At the top of the screen, go to the Service accounts tab.
3. Click next to the service account and select Delete.
4. In the window that opens, click Delete.

What's nextWhat's next

• The step-by-step guides will help you perform specific tasks in Identity and Access Management.
• Read more about service accounts in the concepts section.
• See the best practices for using service accounts securely.