Managing access to a Managed Service for ClickHouse® cluster

Get an IAM token for API authentication and put it into an environment variable:

export IAM_TOKEN="<IAM_token>"

Call the Cluster.ListAccessBindings method, e.g., via the following cURL request:

curl \
  --request GET \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-clickhouse/v1/clusters/<cluster_ID>:listAccessBindings'

View the server response to make sure your request was successful.

Get an IAM token for API authentication and put it into an environment variable:

export IAM_TOKEN="<IAM_token>"

Clone the cloudapi repository:

cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi

Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

Call the ClusterService.ListAccessBindings method, e.g., via the following gRPCurl request:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/clickhouse/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>"
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.clickhouse.v1.ClusterService.ListAccessBindings

Check the server response to make sure your request was successful.

Open the current configuration file with the Managed Service for ClickHouse® cluster description.

For more on how to create this file, see Creating a ClickHouse® cluster.

Add a resource description:

resource "yandex_mdb_clickhouse_cluster_iam_binding" "<local_resource_name>" {
  cluster_id = "<cluster_ID>"
  role       = "<role>"
  members    = ["<subject_type>:<subject_ID>"]
}

Where:

• cluster_id: Cluster ID.

• role: Role, e.g., managed-clickhouse.editor.

• members: List of designations of subjects the role is assigned to.

  Here is an example:

  • serviceAccount:${yandex_iam_service_account.mch_sa.id}
  • userAccount:ajerq94vab34********
  • system:allAuthenticatedUsers
  Subject designations

  To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. Here is how you can designate a subject:

  Subject type	Subject designation
  userAccount	userAccount:<user_ID>
  serviceAccount	serviceAccount:<service_account_ID>
  federatedUser	federatedUser:<user_ID>
  group	group:<group_ID>
  system	system:allAuthenticatedUsers (All authenticated users group)
  	system:allUsers (All users group)
  	system:group:organization:<organization_ID>:users (All users in organization X group)
  	system:group:federation:<federation_ID>:users (All users in federation N group)
  	system:group:userpool:<pool_ID>:users (All users in userpool P group)

Make sure the configuration files are correct.

1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

2. Run this command:

   terraform validate
   

   Terraform will show any errors found in your configuration files.

Confirm resource changes.

1. Run this command to view the planned changes:

   terraform plan
   

   If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

2. If everything looks correct, apply the changes:

   1. Run this command:

      terraform apply
      

   2. Confirm updating the resources.

   3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

To view a list of roles assigned for the cluster, run this CLI command:

yc managed-clickhouse cluster list-access-bindings <cluster_name_or_ID>

Get an IAM token for API authentication and put it into an environment variable:

export IAM_TOKEN="<IAM_token>"

Call the Cluster.UpdateAccessBindings method, e.g., via the following cURL request:

curl \
  --request PATCH \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-clickhouse/v1/clusters/<cluster_ID>:updateAccessBindings' \
  --data '{
            "access_binding_deltas": [
              {
                "action": "ADD",
                "access_binding": {
                  "role_id": "<role>",
                  "subject": {
                    "id": "<subject_ID>",
                    "type": "<subject_type>"
                  }
                }
              }
            ]
          }'

Where:

• access_binding_deltas.roleId: Role, e.g., managed-clickhouse.editor.

• access_binding_deltas.subject.id: ID of the subject getting the role.

• access_binding_deltas.subject.type: Type of subject the role is assigned to.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

Check the server response to make sure your request was successful.

Get an IAM token for API authentication and put it into an environment variable:

export IAM_TOKEN="<IAM_token>"

Clone the cloudapi repository:

cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi

Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

Call the ClusterService.UpdateAccessBindings method, e.g., via the following gRPCurl request:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/clickhouse/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>",
        "access_binding_deltas": [
          {
            "action": "ADD",
            "access_binding": {
              "role_id": "<role>",
              "subject": {
                "id": "<subject_ID>",
                "type": "<subject_type>"
              }
            }
          }
        ]
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.clickhouse.v1.ClusterService.UpdateAccessBindings

Where:

• resource_id: Cluster ID.

• access_binding_deltas.roleId: Role, e.g., managed-clickhouse.editor.

• access_binding_deltas.subject.id: ID of the subject getting the role.

• access_binding_deltas.subject.type: Type of subject the role is assigned to.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

Check the server response to make sure your request was successful.

Open the current Terraform configuration file with the infrastructure plan.

For more on how to create this file, see Creating a cluster.

Add resource descriptions:

resource "yandex_mdb_clickhouse_cluster_iam_binding" "<resource_1_local_name>" {
  cluster_id = "<cluster_ID>"
  role       = "<role_1>"
  members    = ["<subject_type>:<subject_ID>"]
}

resource "yandex_mdb_clickhouse_cluster_iam_binding" "<resource_2_local_name>" {
  cluster_id = "<cluster_ID>"
  role       = "<role_2>"
  members    = ["<subject_type>:<subject_ID>"]
}

Where:

• cluster_id: Cluster ID.

• role: Role, e.g., managed-clickhouse.editor.

• members: List of designations of subjects the role is assigned to.

  Here is an example:

  • serviceAccount:${yandex_iam_service_account.mch_sa.id}
  • userAccount:ajerq94vab34********
  • system:allAuthenticatedUsers
  Subject designations

  To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. Here is how you can designate a subject:

  Subject type	Subject designation
  userAccount	userAccount:<user_ID>
  serviceAccount	serviceAccount:<service_account_ID>
  federatedUser	federatedUser:<user_ID>
  group	group:<group_ID>
  system	system:allAuthenticatedUsers (All authenticated users group)
  	system:allUsers (All users group)
  	system:group:organization:<organization_ID>:users (All users in organization X group)
  	system:group:federation:<federation_ID>:users (All users in federation N group)
  	system:group:userpool:<pool_ID>:users (All users in userpool P group)

Make sure the configuration files are correct.

1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

2. Run this command:

   terraform validate
   

   Terraform will show any errors found in your configuration files.

Confirm resource changes.

1. Run this command to view the planned changes:

   terraform plan
   

   If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

2. If everything looks correct, apply the changes:

   1. Run this command:

      terraform apply
      

   2. Confirm updating the resources.

   3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

To view a list of roles assigned for the cluster, run this CLI command:

yc managed-clickhouse cluster list-access-bindings <cluster_name_or_ID>

Get an IAM token for API authentication and put it into an environment variable:

export IAM_TOKEN="<IAM_token>"

Call the Cluster.SetAccessBindings method, e.g., via the following cURL request:

curl \
  --request POST \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-clickhouse/v1/clusters/<cluster_ID>:setAccessBindings' \
  --data '{
            "accessBindings": [
              {
                "roleId": "<role>",
                "subject": {
                  "id": "<subject_1_ID>",
                  "type": "<subject_type>"
                }
              },
              {
                "roleId": "<role>",
                "subject": {
                  "id": "<subject_2_ID>",
                  "type": "<subject_type>"
                }
              },
              ...
              {
                "roleId": "<role>",
                "subject": {
                  "id": "<subject_N_ID>",
                  "type": "<subject_type>"
                }
              }
            ]
          }'

Where:

• accessBindings.roleId: Role, e.g., managed-clickhouse.editor.

• accessBindings.subject.id: ID of the subject getting the role.

• accessBindings.subject.type: Type of subject the role is assigned to.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

Check the server response to make sure your request was successful.

Get an IAM token for API authentication and put it into an environment variable:

export IAM_TOKEN="<IAM_token>"

Clone the cloudapi repository:

cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi

Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

Call the ClusterService.SetAccessBindings method, e.g., via the following gRPCurl request:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/clickhouse/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>",
        "accessBindings": [
          {
            "roleId": "<role>",
            "subject": {
              "id": "<subject_1_ID>",
              "type": "<subject_type>"
            }
          },
          {
            "roleId": "<role>",
            "subject": {
              "id": "<subject_2_ID>",
              "type": "<subject_type>"
            }
          },
          ...
          {
            "roleId": "<role>",
            "subject": {
              "id": "<subject_N_ID>",
              "type": "<subject_type>"
            }
          }
        ]
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.clickhouse.v1.ClusterService.SetAccessBindings

Where:

• resource_id: Cluster ID.

• accessBindings.roleId: Role, e.g., managed-clickhouse.editor.

• accessBindings.subject.id: ID of the subject getting the role.

• accessBindings.subject.type: Type of subject the role is assigned to.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

Check the server response to make sure your request was successful.

Open the current Terraform configuration file with the infrastructure plan.

For more on how to create this file, see Creating a cluster.

Find the description of the resource with the role you want to revoke and delete this description:

resource "yandex_mdb_clickhouse_cluster_iam_binding" "<local_resource_name>" {
  cluster_id = "<cluster_ID>"
  role       = "<role>"
  members    = ["<subject_type>:<subject_ID>"]
}

Make sure the configuration files are correct.

1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

2. Run this command:

   terraform validate
   

   Terraform will show any errors found in your configuration files.

Confirm resource changes.

1. Run this command to view the planned changes:

   terraform plan
   

   If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

2. If everything looks correct, apply the changes:

   1. Run this command:

      terraform apply
      

   2. Confirm updating the resources.

   3. Wait for the operation to complete.

For more information, see this Terraform provider guide.

To view a list of roles assigned for the cluster, run this CLI command:

yc managed-clickhouse cluster list-access-bindings <cluster_name_or_ID>

Get an IAM token for API authentication and put it into an environment variable:

export IAM_TOKEN="<IAM_token>"

Call the Cluster.UpdateAccessBindings method, e.g., via the following cURL request:

curl \
  --request PATCH \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-clickhouse/v1/clusters/<cluster_ID>:updateAccessBindings' \
  --data '{
            "access_binding_deltas": [
              {
                "action": "REMOVE",
                "access_binding": {
                  "role_id": "<role>",
                  "subject": {
                    "id": "<subject_ID>",
                    "type": "<subject_type>"
                  }
                }
              }
            ]
          }'

Where:

• access_binding_deltas.roleId: Role being revoked, e.g., managed-clickhouse.editor.

• access_binding_deltas.subject.id: ID of the subject to revoke the role from.

• access_binding_deltas.subject.type: Subject type to revoke a role from.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

Check the server response to make sure your request was successful.

Get an IAM token for API authentication and put it into an environment variable:

export IAM_TOKEN="<IAM_token>"

Clone the cloudapi repository:

cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi

Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

Call the ClusterService.UpdateAccessBindings method, e.g., via the following gRPCurl request:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/clickhouse/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>",
        "access_binding_deltas": [
          {
            "action": "REMOVE",
            "access_binding": {
              "role_id": "<role>",
              "subject": {
                "id": "<subject_ID>",
                "type": "<subject_type>"
              }
            }
          }
        ]
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.clickhouse.v1.ClusterService.UpdateAccessBindings

Where:

• resource_id: Cluster ID.

• access_binding_deltas.roleId: Role being revoked, e.g., managed-clickhouse.editor.

• access_binding_deltas.subject.id: ID of the subject to revoke the role from.

• access_binding_deltas.subject.type: Subject type to revoke a role from.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

Check the server response to make sure your request was successful.

Open the current Terraform configuration file with the infrastructure plan.

For more on how to create this file, see Creating a cluster.

Add resource descriptions:

resource "yandex_resourcemanager_folder_iam_member" "mch-viewer-account-iam" {
  folder_id   = "<folder_ID>"
  role        = "managed-clickhouse.viewer"
  member      = "serviceAccount:<service_account_ID>"
}

resource "yandex_mdb_clickhouse_cluster_iam_binding" "mch-cluster-api-editor" {
  cluster_id = "<cluster_ID>"
  role       = "managed-clickhouse.editor"
  members    = ["serviceAccount:<service_account_ID>"]
}

Make sure the configuration files are correct.

1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.

2. Run this command:

   terraform validate
   

   Terraform will show any errors found in your configuration files.

Confirm resource changes.

1. Run this command to view the planned changes:

   terraform plan
   

   If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.

2. If everything looks correct, apply the changes:

   1. Run this command:

      terraform apply
      

   2. Confirm updating the resources.

   3. Wait for the operation to complete.

Get an IAM token for API authentication and put it into an environment variable:

export IAM_TOKEN="<IAM_token>"

Assign the role for the folder:

curl \
  --request POST \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/<folder_ID>:updateAccessBindings' \
  --data '{
            "access_binding_deltas": [
              {
                "action": "ADD",
                "access_binding": {
                  "role_id": "managed-clickhouse.viewer",
                  "subject": {
                    "id": "<service_account_ID>",
                    "type": "serviceAccount"
                  }
                }
              }
            ]
          }'

access_binding_deltas.subject.id: ID of the service account the role is assigned to.

Call the Cluster.UpdateAccessBindings method, e.g., via the following cURL request:

curl \
  --request PATCH \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-clickhouse/v1/clusters/<cluster_ID>:updateAccessBindings' \
  --data '{
            "access_binding_deltas": [
              {
                "action": "ADD",
                "access_binding": {
                  "role_id": "managed-clickhouse.editor",
                  "subject": {
                    "id": "<service_account_ID>",
                    "type": "serviceAccount"
                  }
                }
              }
            ]
          }'

access_binding_deltas.subject.id: ID of the service account the role is assigned to.

Check the list of roles assigned for the folder:

curl \
  --request GET \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/<folder_ID>:updateAccessBindings'

Check the list of roles assigned for the cluster:

curl \
  --request GET \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-clickhouse/v1/clusters/<cluster_ID>:listAccessBindings'

Get an IAM token for API authentication and put it into an environment variable:

export IAM_TOKEN="<IAM_token>"

Clone the cloudapi repository:

cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi

Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

Assign the role for the folder:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/resourcemanager/v1/folder_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>",
        "access_binding_deltas": [
          {
            "action": "ADD",
            "access_binding": {
              "role_id": "managed-clickhouse.viewer",
              "subject": {
                "id": "<service_account_ID>",
                "type": "serviceAccount"
              }
            }
          }
        ]
      }' \
  resource-manager.api.cloud.yandex.net:443 \
  yandex.cloud.resourcemanager.v1.FolderService.UpdateAccessBindings

access_binding_deltas.subject.id: ID of the service account the role is assigned to.

Assign the role for the cluster:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/clickhouse/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>",
        "access_binding_deltas": [
          {
            "action": "ADD",
            "access_binding": {
              "role_id": "managed-clickhouse.editor",
              "subject": {
                "id": "<service_account_ID>",
                "type": "serviceAccount"
              }
            }
          }
        ]
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.clickhouse.v1.ClusterService.UpdateAccessBindings

access_binding_deltas.subject.id: ID of the service account the role is assigned to.

Check the list of roles assigned for the folder:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/resourcemanager/v1/folder_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<folder_ID>"
      }' \
  resource-manager.api.cloud.yandex.net:443 \
  yandex.cloud.resourcemanager.v1.FolderService.ListAccessBindings

Check the list of roles assigned for the cluster:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/clickhouse/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>"
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.clickhouse.v1.ClusterService.ListAccessBindings