Managing access to a Managed Service for Apache Kafka® cluster

Written by

Yandex Cloud

Improved by

ilya

Updated at September 25, 2026

View in Markdown

Getting a list of roles assigned for a cluster
Assigning a role
Assigning multiple roles
Revoking a role
Examples
- Granting cluster management access to a service account

You can assign a user or service account a role that grants access to a specific cluster.

Thus, you can granularly assign different roles for particular clusters to different users and service accounts.

Getting a list of roles assigned for a cluster

CLI

REST API

gRPC API

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To get a list of clusters in the default folder, run this command:
```
yc managed-kafka cluster list
```

To get a list of roles assigned for the cluster, run this command:

yc managed-kafka cluster list-access-bindings <cluster_name_or_ID>

Get an IAM token for API authentication and place it in an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```

Call the Cluster.ListAccessBindings method, e.g., via the following cURL request:

curl \
  --request GET \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>:listAccessBindings'

View the server response to make sure your request was successful.

Get an IAM token for API authentication and place it in an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Clone the cloudapi repository:
```
cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
```
Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

Call the ClusterService.ListAccessBindings method, e.g., via the following gRPCurl request:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>"
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.kafka.v1.ClusterService.ListAccessBindings

Check the server response to make sure your request was successful.

Assigning a role

CLI

REST API

gRPC API

If you do not have the Yandex Cloud CLI yet, install and initialize it.

View the description of the CLI command for assigning a role for a cluster:
```
yc managed-kafka cluster add-access-binding --help
```

Use this command to assign a role:

yc managed-kafka cluster add-access-binding <cluster_name_or_ID> \
  --role <role> \
  --subject <subject_type>:<subject_ID>

Where:

--role: Role, e.g., managed-kafka.editor.

--subject: Subject getting the role.

Here is an example:

serviceAccount:aje6p030************
userAccount:aje8tj79************
system:allAuthenticatedUsers

Subject designations

To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and matching CLI parameters:

Subject type	Subject designation	Yandex Cloud CLI parameter
`userAccount`	`userAccount:<user_ID>`	`--user-account-id` or `--user-yandex-login`
`serviceAccount`	`serviceAccount:<service_account_ID>`	`--service-account-id` or `--service-account-name`
`federatedUser`	`federatedUser:<user_ID>`	`--user-account-id`
`group`	`group:<group_ID>`	`--group-members`
`system`	`system:allAuthenticatedUsers` (`All authenticated users` group)	`--all-authenticated-users`
	`system:allUsers` (`All users` group)	—
	`system:group:organization:<organization_ID>:users` (`All users in organization X` group)	`--organization-users`
	`system:group:federation:<federation_ID>:users` (`All users in federation N` group)	`--federation-users`
	`system:group:userpool:<pool_ID>:users` (`All users in userpool P` group)	—

To view a list of roles assigned for the cluster, run this command:

yc managed-kafka cluster list-access-bindings <cluster_name_or_ID>

Get an IAM token for API authentication and place it in an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```

Call the Cluster.UpdateAccessBindings method, e.g., via the following cURL request:

curl \
  --request PATCH \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>:updateAccessBindings' \
  --data '{
            "access_binding_deltas": [
              {
                "action": "ADD",
                "access_binding": {
                  "role_id": "<role>",
                  "subject": {
                    "id": "<subject_ID>",
                    "type": "<subject_type>"
                  }
                }
              }
            ]
          }'

Where:

access_binding_deltas.roleId: Role, e.g., managed-kafka.editor.
access_binding_deltas.subject.id: ID of the subject the role is assigned to.

access_binding_deltas.subject.type: Type of subject the role is assigned to.

Subject designations

To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

subject.type	subject.id
`userAccount`	`<user_ID>`
`serviceAccount`	`<service_account_ID>`
`federatedUser`	`<user_ID>`
`group`	`<group_ID>`
`system`	`allAuthenticatedUsers` (`All authenticated users` group)
	`allUsers` (`All users` group)
	`group:organization:<organization_ID>:users` (`All users in organization X` group)
	`group:federation:<federation_ID>:users` (`All users in federation N` group)
	`group:userpool:<pool_ID>:users` (`All users in userpool P` group)

Check the server response to make sure your request was successful.

Get an IAM token for API authentication and place it in an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Clone the cloudapi repository:
```
cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
```
Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

Call the ClusterService.UpdateAccessBindings method, e.g., via the following gRPCurl request:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>",
        "access_binding_deltas": [
          {
            "action": "ADD",
            "access_binding": {
              "role_id": "<role>",
              "subject": {
                "id": "<subject_ID>",
                "type": "<subject_type>"
              }
            }
          }
        ]
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.kafka.v1.ClusterService.UpdateAccessBindings

Where:

resource_id: Cluster ID.
access_binding_deltas.roleId: Role, e.g., managed-kafka.editor.
access_binding_deltas.subject.id: ID of the subject the role is assigned to.

access_binding_deltas.subject.type: Type of subject the role is assigned to.

Subject designations

To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

subject.type	subject.id
`userAccount`	`<user_ID>`
`serviceAccount`	`<service_account_ID>`
`federatedUser`	`<user_ID>`
`group`	`<group_ID>`
`system`	`allAuthenticatedUsers` (`All authenticated users` group)
	`allUsers` (`All users` group)
	`group:organization:<organization_ID>:users` (`All users in organization X` group)
	`group:federation:<federation_ID>:users` (`All users in federation N` group)
	`group:userpool:<pool_ID>:users` (`All users in userpool P` group)

Check the server response to make sure your request was successful.

Assigning multiple roles

CLI

REST API

gRPC API

If you do not have the Yandex Cloud CLI yet, install and initialize it.

Alert

The set-access-bindings command deletes all roles assigned for the cluster and assigns new ones.

To view a list of roles assigned for the cluster, run this command:

yc managed-kafka cluster list-access-bindings <cluster_name_or_ID>

View the description of the CLI command for assigning roles for a cluster:
```
yc managed-kafka cluster set-access-bindings --help
```

To assign roles, run this command:

yc managed-kafka cluster set-access-bindings <cluster_name_or_ID> \
  --access-binding role=<role>,subject=<subject_type>:<subject_1_ID> \
  --access-binding role=<role>,subject=<subject_type>:<subject_2_ID>

Where --access-binding assigns a role to a subject. You can assign multiple roles at once by describing each of them in a separate --access-binding parameter.

role: Role, e.g., managed-kafka.editor.

subject: Subject getting the role.

Here is an example:

serviceAccount:aje6p030************
userAccount:aje8tj79************
system:allAuthenticatedUsers

Subject designations

Subject type	Subject designation	Yandex Cloud CLI parameter
`userAccount`	`userAccount:<user_ID>`	`--user-account-id` or `--user-yandex-login`
`serviceAccount`	`serviceAccount:<service_account_ID>`	`--service-account-id` or `--service-account-name`
`federatedUser`	`federatedUser:<user_ID>`	`--user-account-id`
`group`	`group:<group_ID>`	`--group-members`
`system`	`system:allAuthenticatedUsers` (`All authenticated users` group)	`--all-authenticated-users`
	`system:allUsers` (`All users` group)	—
	`system:group:organization:<organization_ID>:users` (`All users in organization X` group)	`--organization-users`
	`system:group:federation:<federation_ID>:users` (`All users in federation N` group)	`--federation-users`
	`system:group:userpool:<pool_ID>:users` (`All users in userpool P` group)	—

Alert

The setAccessBindings method overwrites access permissions for the resource. All roles previously assigned for this resource will be deleted.

Get an IAM token for API authentication and place it in an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```

Call the Cluster.SetAccessBindings method, e.g., via the following cURL request:

curl \
  --request POST \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>:setAccessBindings' \
  --data '{
            "accessBindings": [
              {
                "roleId": "<role>",
                "subject": {
                  "id": "<subject_1_ID>",
                  "type": "<subject_type>"
                }
              },
              {
                "roleId": "<role>",
                "subject": {
                  "id": "<subject_2_ID>",
                  "type": "<subject_type>"
                }
              },
              ...
              {
                "roleId": "<role>",
                "subject": {
                  "id": "<subject_N_ID>",
                  "type": "<subject_type>"
                }
              }
            ]
          }'

Where:

accessBindings.roleId: Role, e.g., managed-kafka.editor.
accessBindings.subject.id: ID of the subject the role is assigned to.

accessBindings.subject.type: Type of subject the role is assigned to.

Subject designations

To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

subject.type	subject.id
`userAccount`	`<user_ID>`
`serviceAccount`	`<service_account_ID>`
`federatedUser`	`<user_ID>`
`group`	`<group_ID>`
`system`	`allAuthenticatedUsers` (`All authenticated users` group)
	`allUsers` (`All users` group)
	`group:organization:<organization_ID>:users` (`All users in organization X` group)
	`group:federation:<federation_ID>:users` (`All users in federation N` group)
	`group:userpool:<pool_ID>:users` (`All users in userpool P` group)

Check the server response to make sure your request was successful.

Alert

The ClusterService.SetAccessBindings method completely overwrites access permissions for the resource. All roles previously assigned for this resource will be deleted.

Get an IAM token for API authentication and place it in an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Clone the cloudapi repository:
```
cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
```
Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

Call the ClusterService.SetAccessBindings method, e.g., via the following gRPCurl request:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>",
        "accessBindings": [
          {
            "roleId": "<role>",
            "subject": {
              "id": "<subject_1_ID>",
              "type": "<subject_type>"
            }
          },
          {
            "roleId": "<role>",
            "subject": {
              "id": "<subject_2_ID>",
              "type": "<subject_type>"
            }
          },
          ...
          {
            "roleId": "<role>",
            "subject": {
              "id": "<subject_N_ID>",
              "type": "<subject_type>"
            }
          }
        ]
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.kafka.v1.ClusterService.SetAccessBindings

Where:

resource_id: Cluster ID.
accessBindings.roleId: Role, e.g., managed-kafka.editor.
accessBindings.subject.id: ID of the subject the role is assigned to.

accessBindings.subject.type: Type of subject the role is assigned to.

Subject designations

To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

subject.type	subject.id
`userAccount`	`<user_ID>`
`serviceAccount`	`<service_account_ID>`
`federatedUser`	`<user_ID>`
`group`	`<group_ID>`
`system`	`allAuthenticatedUsers` (`All authenticated users` group)
	`allUsers` (`All users` group)
	`group:organization:<organization_ID>:users` (`All users in organization X` group)
	`group:federation:<federation_ID>:users` (`All users in federation N` group)
	`group:userpool:<pool_ID>:users` (`All users in userpool P` group)

Check the server response to make sure your request was successful.

Revoking a role

CLI

REST API

gRPC API

If you do not have the Yandex Cloud CLI yet, install and initialize it.

To view a list of roles assigned for the cluster, run this command:

yc managed-kafka cluster list-access-bindings <cluster_name_or_ID>

View the description of the CLI command for revoking a role for a cluster:
```
yc managed-kafka cluster remove-access-binding --help
```

To revoke a role, run this command:

yc managed-kafka cluster remove-access-binding <cluster_name_or_ID> \
  --role <role> \
  --subject <subject_type>:<subject_ID>

Where:

--role: Role being revoked, e.g., managed-kafka.editor.

--subject: Subject to revoke the role from.

Here is an example:

serviceAccount:aje6p030************
userAccount:aje8tj79************
system:allAuthenticatedUsers

Subject designations

Subject type	Subject designation	Yandex Cloud CLI parameter
`userAccount`	`userAccount:<user_ID>`	`--user-account-id` or `--user-yandex-login`
`serviceAccount`	`serviceAccount:<service_account_ID>`	`--service-account-id` or `--service-account-name`
`federatedUser`	`federatedUser:<user_ID>`	`--user-account-id`
`group`	`group:<group_ID>`	`--group-members`
`system`	`system:allAuthenticatedUsers` (`All authenticated users` group)	`--all-authenticated-users`
	`system:allUsers` (`All users` group)	—
	`system:group:organization:<organization_ID>:users` (`All users in organization X` group)	`--organization-users`
	`system:group:federation:<federation_ID>:users` (`All users in federation N` group)	`--federation-users`
	`system:group:userpool:<pool_ID>:users` (`All users in userpool P` group)	—

Get an IAM token for API authentication and place it in an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```

Call the Cluster.UpdateAccessBindings method, e.g., via the following cURL request:

curl \
  --request PATCH \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>:updateAccessBindings' \
  --data '{
            "access_binding_deltas": [
              {
                "action": "REMOVE",
                "access_binding": {
                  "role_id": "<role>",
                  "subject": {
                    "id": "<subject_ID>",
                    "type": "<subject_type>"
                  }
                }
              }
            ]
          }'

Where:

access_binding_deltas.roleId: Role being revoked, e.g., managed-kafka.editor.
access_binding_deltas.subject.id: ID of the subject to revoke the role from.

access_binding_deltas.subject.type: Subject type to revoke a role from.

Subject designations

To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

subject.type	subject.id
`userAccount`	`<user_ID>`
`serviceAccount`	`<service_account_ID>`
`federatedUser`	`<user_ID>`
`group`	`<group_ID>`
`system`	`allAuthenticatedUsers` (`All authenticated users` group)
	`allUsers` (`All users` group)
	`group:organization:<organization_ID>:users` (`All users in organization X` group)
	`group:federation:<federation_ID>:users` (`All users in federation N` group)
	`group:userpool:<pool_ID>:users` (`All users in userpool P` group)

Check the server response to make sure your request was successful.

Get an IAM token for API authentication and place it in an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Clone the cloudapi repository:
```
cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
```
Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

Call the ClusterService.UpdateAccessBindings method, e.g., via the following gRPCurl request:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>",
        "access_binding_deltas": [
          {
            "action": "REMOVE",
            "access_binding": {
              "role_id": "<role>",
              "subject": {
                "id": "<subject_ID>",
                "type": "<subject_type>"
              }
            }
          }
        ]
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.kafka.v1.ClusterService.UpdateAccessBindings

Where:

resource_id: Cluster ID.
access_binding_deltas.roleId: Role being revoked, e.g., managed-kafka.editor.
access_binding_deltas.subject.id: ID of the subject to revoke the role from.

access_binding_deltas.subject.type: Subject type to revoke a role from.

Subject designations

To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

subject.type	subject.id
`userAccount`	`<user_ID>`
`serviceAccount`	`<service_account_ID>`
`federatedUser`	`<user_ID>`
`group`	`<group_ID>`
`system`	`allAuthenticatedUsers` (`All authenticated users` group)
	`allUsers` (`All users` group)
	`group:organization:<organization_ID>:users` (`All users in organization X` group)
	`group:federation:<federation_ID>:users` (`All users in federation N` group)
	`group:userpool:<pool_ID>:users` (`All users in userpool P` group)

Check the server response to make sure your request was successful.

Examples

Granting cluster management access to a service account

For a service account to be able to view the info of all Managed Service for Apache Kafka® clusters in the folder but modify the resources in one particular cluster alone, give it the managed-kafka.viewer role for the folder and the managed-kafka.editor role for that cluster:

CLI

REST API

gRPC API

Assign the role for the folder:

yc resource-manager folder add-access-binding <folder_name_or_ID> \
  --role managed-kafka.viewer \
  --subject=serviceAccount:<service_account_ID>

Assign the roles for the cluster:

yc managed-kafka cluster add-access-bindings <cluster_name_or_ID> \
  --access-binding role=managed-kafka.editor,subject=serviceAccount:<service_account_ID>

Check the list of roles assigned for the cluster:

yc managed-kafka cluster list-access-bindings <cluster_name_or_ID>

Get an IAM token for API authentication and place it in an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```

Assign the role for the folder:

curl \
  --request POST \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/<folder_ID>:updateAccessBindings' \
  --data '{
            "access_binding_deltas": [
              {
                "action": "ADD",
                "access_binding": {
                  "role_id": "managed-kafka.viewer",
                  "subject": {
                    "id": "<service_account_ID>",
                    "type": "serviceAccount"
                  }
                }
              }
            ]
          }'

access_binding_deltas.subject.id: ID of the service account the role is assigned to.

Call the Cluster.UpdateAccessBindings method, e.g., via the following cURL request:

curl \
  --request PATCH \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>:updateAccessBindings' \
  --data '{
            "access_binding_deltas": [
              {
                "action": "ADD",
                "access_binding": {
                  "role_id": "managed-kafka.editor",
                  "subject": {
                    "id": "<service_account_ID>",
                    "type": "serviceAccount"
                  }
                }
              }
            ]
          }'

access_binding_deltas.subject.id: ID of the service account the role is assigned to.

Check the list of roles assigned for the folder:

curl \
  --request GET \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/<folder_ID>:updateAccessBindings'

Check the list of roles assigned for the cluster:

curl \
  --request GET \
  --header "Authorization: Bearer $IAM_TOKEN" \
  --header "Content-Type: application/json" \
  --url 'https://mdb.api.cloud.yandex.net/managed-kafka/v1/clusters/<cluster_ID>:listAccessBindings'

Get an IAM token for API authentication and place it in an environment variable:
```
export IAM_TOKEN="<IAM_token>"
```
Clone the cloudapi repository:
```
cd ~/ && git clone --depth=1 https://github.com/yandex-cloud/cloudapi
```
Below, we assume that the repository contents reside in the ~/cloudapi/ directory.

Assign the role for the folder:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/resourcemanager/v1/folder_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>",
        "access_binding_deltas": [
          {
            "action": "ADD",
            "access_binding": {
              "role_id": "managed-kafka.viewer",
              "subject": {
                "id": "<service_account_ID>",
                "type": "serviceAccount"
              }
            }
          }
        ]
      }' \
  resource-manager.api.cloud.yandex.net:443 \
  yandex.cloud.resourcemanager.v1.FolderService.UpdateAccessBindings

access_binding_deltas.subject.id: ID of the service account the role is assigned to.

Assign the role for the cluster:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>",
        "access_binding_deltas": [
          {
            "action": "ADD",
            "access_binding": {
              "role_id": "managed-kafka.editor",
              "subject": {
                "id": "<service_account_ID>",
                "type": "serviceAccount"
              }
            }
          }
        ]
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.kafka.v1.ClusterService.UpdateAccessBindings

access_binding_deltas.subject.id: ID of the service account the role is assigned to.

Check the list of roles assigned for the folder:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/resourcemanager/v1/folder_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<folder_ID>"
      }' \
  resource-manager.api.cloud.yandex.net:443 \
  yandex.cloud.resourcemanager.v1.FolderService.ListAccessBindings

Check the list of roles assigned for the cluster:

grpcurl \
  -format json \
  -import-path ~/cloudapi/ \
  -import-path ~/cloudapi/third_party/googleapis/ \
  -proto ~/cloudapi/yandex/cloud/mdb/kafka/v1/cluster_service.proto \
  -rpc-header "Authorization: Bearer $IAM_TOKEN" \
  -d '{
        "resource_id": "<cluster_ID>"
      }' \
  mdb.api.cloud.yandex.net:443 \
  yandex.cloud.mdb.kafka.v1.ClusterService.ListAccessBindings

Managing access to a Managed Service for Apache Kafka® cluster

Getting a list of roles assigned for a clusterGetting a list of roles assigned for a cluster

Assigning a roleAssigning a role

Assigning multiple rolesAssigning multiple roles

Revoking a roleRevoking a role

ExamplesExamples

Granting cluster management access to a service accountGranting cluster management access to a service account

Was the article helpful?

Getting a list of roles assigned for a cluster

Assigning a role

Assigning multiple roles

Revoking a role

Examples

Granting cluster management access to a service account