Access management in Yandex Lockbox
In this section, you will learn:
- Which resources you can assign a role for.
- Which roles exist in the service.
- Which roles are required for particular actions.
About access management
In Yandex Cloud, all transactions are checked in Yandex Identity and Access Management. If a subject does not have the required permission, the service returns an error.
To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Yandex Cloud.
Only users with the admin
, resource-manager.clouds.owner
, or organization-manager.organizations.owner
role for a resource can assign roles for this resource.
Which resources you can assign a role for
Roles can be assigned for a cloud, folder, or secret. These roles also apply to nested resources.
The chart below shows which roles are available in the service and how they inherit each other's permissions. For example, the editor
role includes all the permissions of viewer
. You can find the description of each role under the chart.
Which roles exist in the service
You can manage access to secrets using both service and primitive roles.
Service roles
lockbox.auditor
The lockbox.auditor
role allows you to get information about secrets and permissions to them, folder data, and information about Yandex Lockbox quotas.
lockbox.viewer
The lockbox.viewer
role lets you read the metadata of the secret.
The role includes all permissions granted by the lockbox.auditor
role.
lockbox.editor
The lockbox.editor
role lets you manage a secret and change its contents.
lockbox.admin
The lockbox.admin
role lets you manage your secrets and access to them.
lockbox.payloadViewer
The lockbox.payloadViewer
role is designed for service accounts and lets you access the contents of the secret.
Primitive roles
auditor
Grants permission to view service configuration and metadata without access to data.
viewer
Enables you to view information about resources.
editor
Allows managing (creating, editing, and deleting) resources.
admin
Allows you to manage your resources and access to them.
For more information about primitive roles, see the Yandex Cloud role reference.
What roles do I need
The table below lists the roles needed to perform a particular action. You can always assign a role granting more permissions than the role specified. For example, you can assign the editor
role instead of the viewer
one.
Action | lockbox.admin |
lockbox.editor |
lockbox.viewer |
lockbox.payloadViewer |
kms.keys.encrypterDecrypter |
---|---|---|---|---|---|
Create and delete secrets | - | - | - | ||
Change the metadata of the secret | - | - | - | ||
Read the metadata of the secret | - | - | |||
Change the content of the secret version | - | - | - | ||
Read the content of the secret version | - | - | - | ||
Control access to the secret | - | - | - | - | |
Secret encryption and decryption operations | - | - | - | - |