Configuring group management access

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To grant access permissions for a user group:

1. View the description of the CLI command for assigning roles:

   yc organization-manager group add-access-binding --help
   

2. Get a list of user groups with their IDs:

   yc organization-manager group list \
     --organization-id <organization_ID>
   

3. Get the ID of the user, service account, or user group you need to grant access to the group.

4. Use the yc organization-manager group add-access-binding command to assign the following role:

   yc organization-manager group add-access-binding \
     --id <group_ID> \
     --role <role> \
     --subject <subject_type>:<subject_ID>
   

   Where:

   • --id: ID of the user group to grant access to.

   • --role: Role ID.

   • --subject: Subject getting the role.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and the corresponding CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. Get the ID of the user, service account, or user group you need to grant access to the group.

2. Describe the parameters of the roles you assign in the configuration file:

   resource "yandex_organizationmanager_group_iam_member" "editor" {
     group_id = "<group_ID>"
     role     = "<role_ID>"
     member   = "<subject>"
   }
   

   Where:

   • group_id: User group ID.

   • role: Role. This is a required setting.

   • member: Subject getting the role. This is a required setting.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more on the properties of the yandex_organizationmanager_group_iam_member resource, see this provider guide.

3. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

With this done, the specified subjects will get their roles for the user group. You can check the role assignment using the Cloud Center UI.

To assign a role for a user group to a subject, use the updateAccessBindings REST API method for the Group resource or the GroupService/UpdateAccessBindings gRPC API call and provide the following in the request:

• ADD value in the accessBindingDeltas[].action parameter to add a role.

• Role in the accessBindingDeltas[].accessBinding.roleId parameter.

• ID of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.id parameter.

• Type of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.type parameter.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

To assign multiple roles for a user group:

1. Make sure the resource has no important roles assigned before proceeding:

   yc organization-manager group list-access-bindings \
     --id <group_ID>
   

2. View the description of the CLI command for assigning roles:

   yc organization-manager group set-access-bindings --help
   

3. Get a list of user groups with their IDs:

   yc organization-manager group list
   

4. Get the ID of the user, service account, or user group you need to grant access to the group.

5. Use the yc organization-manager group set-access-bindings command to assign the following roles:

   yc organization-manager group set-access-bindings \
     --id <group_ID> \
     --access-binding role=<role>,subject=<subject_type>:<subject_ID>
   

   Where:

   • --id: ID of the user group to grant access to.

   • role: ID of the role you need to assign.

   • subject: Subject getting the role.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   Provide a separate --access-binding parameter for each role. Here is an example:

   yc organization-manager group set-access-bindings \
     --id ins672qpemb4******** \
     --access-binding role=<role1>,subject=serviceAccount:<service_account_ID> \
     --access-binding role=<role2>,subject=serviceAccount:<service_account_ID> \
     --access-binding role=<role3>,subject=serviceAccount:<service_account_ID>
   

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

To assign multiple roles for a user group:

1. Describe the parameters of the roles you assign in the configuration file:

   resource "yandex_organizationmanager_group_iam_member" "role1" {
     group_id = "<group_ID>"
     role     = "<role1>"
     member   = "<subject_type>:<subject_ID>"
   }
   
   resource "yandex_organizationmanager_group_iam_member" "role2" {
     group_id = "<group_ID>"
     role     = "<role2>"
     member   = "<subject_type>:<subject_ID>"
   }
   
   resource "yandex_organizationmanager_group_iam_member" "role3" {
     group_id = "<group_ID>"
     role     = "<role3>"
     member   = "<subject_type>:<subject_ID>"
   }
   

   Where:

   • group_id: User group ID.

   • role: Role you want to assign.

   • member: Subject getting the role.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more on the properties of the yandex_organizationmanager_group_iam_member resource, see this provider guide.

2. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

With this done, the specified subject will get several roles for the user group. You can check role assignments using the Cloud Center UI.

To assign several roles for a user group to a subject, use the setAccessBindings REST API method for the Group resource or the GroupService/SetAccessBindings gRPC API call. In your request, provide an array of objects, each one matching a particular role and containing the following data:

• Role in the accessBindings[].roleId parameter.

• ID of the subject getting the roles in the accessBindings[].subject.id parameter.

• Type of the subject getting the roles in the accessBindings[].subject.type parameter.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

1. See the description of the CLI command to revoke a role:

   yc organization-manager group remove-access-binding --help
   

2. Get a list of user groups with their IDs:

   yc organization-manager group list \
     --organization-id <organization_ID>
   

3. Get the ID of the user, service account, or user group you are revoking a role from.

4. Use the yc organization-manager group remove-access-binding command to revoke the role from the subject:

   yc organization-manager group remove-access-binding \
     --id <group_ID> \
     --role <role> \
     --subject <subject_type>:<subject_ID>
   

   Where:

   • --id: ID of the user group to which access was granted.

   • --role: ID of the role you want to revoke.

   • --subject: Subject to revoke the role from.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and the corresponding CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

To revoke a role from a user, service account, or user group:

1. Open the Terraform configuration file and remove the part containing the yandex_organizationmanager_group_iam_member resource for the role you want to revoke.

   resource "yandex_organizationmanager_group_iam_member" "editor" {
     group_id = "<group_ID>"
     role     = "<role_ID>"
     member   = "<subject_type>:<subject_ID>"
   }
   

   Where:

   • group_id: User group ID.

   • role: Role being revoked. This is a required setting.

   • member: Subject to revoke the role from. This is a required setting.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

2. Apply the changes:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

The role will be revoked from the subject you indicated. You can check the role is no longer assigned using the Cloud Center UI.

To revoke a role for a user group from a subject, use the updateAccessBindings REST API method for the Group resource or the GroupService/UpdateAccessBindings gRPC API call and provide the following in the request:

• REMOVE in the accessBindingDeltas[].action parameter to revoke the role.

• Role in the accessBindingDeltas[].accessBinding.roleId parameter.

• ID of the subject to revoke the role from in the accessBindingDeltas[].accessBinding.subject.id parameter.

• Type of the subject to revoke the role from in the accessBindingDeltas[].accessBinding.subject.type parameter.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)