Assigning a role to a user group

If you do not have the Yandex Cloud CLI yet, install and initialize it.

1. Select a role from the Yandex Cloud role reference.

2. Assign a role using this command:

   yc <service_name> <resource> add-access-binding <resource_name_or_ID> \
     --role <role_ID> \
     --subject group:<group_ID>
   

   Where:

   • --role: Role ID, e.g., resource-manager.clouds.owner.

   • --subject: Subject getting the role.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and the corresponding CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

   For example, assign the resource-manager.viewer role for the my-cloud cloud.

   yc resource-manager cloud add-access-binding mycloud \
     --role resource-manager.viewer \
     --subject group:aje6o61dvog2********
   

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. Add the resource parameters to the configuration file and specify the required role and group:

   resource "yandex_resourcemanager_cloud_iam_member" "admin" {
     cloud_id = "<cloud_ID>"
     role     = "<role_ID>"
     member   = "group:<group_ID>"
   }
   

   Where:

   • cloud_id: Cloud ID. To assign a role for a folder, use the yandex_resourcemanager_folder_iam_member resource and specify folder_id.

   • role: Role to assign. This is a required setting.

   • member: Subject getting the role. This is a required setting.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more on the properties of the yandex_resourcemanager_cloud_iam_member and yandex_resourcemanager_folder_iam_member resources, see the relevant provider guide for the cloud and folder.

2. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   With this done, the specified access permissions will be assigned. You can check the role assignment using the management console or this CLI command:

   yc resource-manager <cloud_or_folder> list-access-bindings <name_or_ID_of_cloud_or_folder>
   

To assign a role for a cloud to a group of users, use the updateAccessBindings REST API method for the Cloud resource or the CloudService/UpdateAccessBindings gRPC API call.

To assign a role for a folder to a group of users, use the updateAccessBindings REST API method for the Folder resource or the FolderService/UpdateAccessBindings gRPC API call.

Provide the following in the request:

• ADD value in the accessBindingDeltas[].action parameter to add a role.

• Role in the accessBindingDeltas[].accessBinding.roleId parameter.

• ID of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.id parameter.

• Type of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.type parameter.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

To learn how to assign a role for the respective resource, see:

• Setting up service account access permissions.
• Setting up cloud access permissions.
• Setting up folder access permissions.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

1. Assign a role for an organization to a group:

   yc organization-manager organization add-access-binding \
     --id <organization_ID> \
     --role <role_ID> \
     --subject group:<group_ID>
   

   Where:

   • --id: ID of the organization you are assigning a role for.

   • --role: ID of the role you need to assign.

   • --subject: Subject getting the role.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and the corresponding CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

2. Make sure the requested permissions are granted:

   yc organization-manager organization list-access-bindings <organization_ID>
   

   A response contains a list of all roles assigned to users and groups in the organization:

   +------------------------------------------+--------------+----------------------+
   |                 ROLE ID                  | SUBJECT TYPE |      SUBJECT ID      |
   +------------------------------------------+--------------+----------------------+
   | organization-manager.admin               | userAccount  | ajev1p2345lj******** |
   | organization-manager.organizations.owner | userAccount  | ajev1p2345lj******** |
   | editor                                   | group        | ajev1p2345lj******** |
   | viewer                                   | group        | ajev1p2345lj******** |
   +------------------------------------------+--------------+----------------------+
   

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. Add the resource parameters to the configuration file and specify the required role and group:

   resource "yandex_organizationmanager_organization_iam_member" "users-editors" {
     organization_id = "<organization_ID>"
     role            = "<role_ID>"
     member          = "group:<group_ID>"
   }
   

   Where:

   • organization_id: Organization ID. This is a required setting.

   • role: Role being assigned. This is a required setting.

   • member: Subject getting the role. This is a required setting.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more on the properties of the yandex_organizationmanager_organization_iam_member resource, see this provider guide.

2. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   With this done, the specified access permissions will be assigned. You can check the role assignment using the Cloud Center UI or this CLI command:

   yc organization-manager organization list-access-bindings <organization_ID>
   

To assign a role for an organization to a user group, use the updateAccessBindings REST API method for the Organization resource or the OrganizationService/UpdateAccessBindings gRPC API call and provide the following in the request:

• ADD value in the accessBindingDeltas[].action parameter to add a role.

• Role in the accessBindingDeltas[].accessBinding.roleId parameter.

• ID of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.id parameter.

• Type of the subject getting the role in the accessBindingDeltas[].accessBinding.subject.type parameter.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)