Assigning a user as an organization administrator

If you do not have the Yandex Cloud CLI yet, install and initialize it.

1. Get the user ID.

2. Assign a role using this command:

   yc organization-manager organization add-access-binding <organization_name_or_ID> \
     --role <role_ID> \
     --user-account-id <user_ID>
   

   Where:

   • --role: Role ID. Specify the organization-manager.admin role.
   • --user-account-id: User ID. You can also use the --user-yandex-login parameter and specify the username instead of the ID.

   For example, this command assigns the administrator role for the organization with the bpf3crucp1v2******** ID:

   yc organization-manager organization add-access-binding bpf3crucp1v2******** \
     --role organization-manager.admin \
     --user-account-id aje6o61dvog2********
   

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. Describe the parameters of the roles you assign in the configuration file:

   resource "yandex_organizationmanager_organization_iam_binding" "org_admin_role" {
     organization_id = "<organization_ID>"
     role            = "organization-manager.admin"
     member          = "userAccount:<user_ID>"
   }
   

   Where:

   • organization_id: Organization ID.

   • role: Specify the organization-manager.admin role. For each role, you can only use one yandex_organizationmanager_organization_iam_binding resource.

   • member: Subject getting the role.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more on the properties of the yandex_organizationmanager_organization_iam_binding resource, see this provider guide.

2. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

The user will thus be assigned the organization administrator role. You can check the role assignment using the Cloud Center UI.

To assign a user the organization administrator role, use the updateAccessBindings REST API method for the Organization resource or the OrganizationService/UpdateAccessBindings gRPC API call and provide the following in the request:

• ADD value in the accessBindingDeltas[].action parameter to add a role.

• Role in the accessBindingDeltas[].accessBinding.roleId parameter.

• ID of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.id parameter.

• Type of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.type parameter.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)