Setting up folder access permissions

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

1. View the description of the command to assign a role for a folder:

   yc resource-manager folder add-access-binding --help
   

2. Get a list of available folders:

   yc resource-manager folder list
   

   Result:

   +----------------------+-----------+--------+--------+
   |          ID          |   NAME    | LABELS | STATUS |
   +----------------------+-----------+--------+--------+
   | b1gd129pp9ha******** | my-folder |        | ACTIVE |
   +----------------------+-----------+--------+--------+
   

3. Get a list of available roles:

   yc iam role list
   

   Result:

   +--------------------------------+-------------+
   |               ID               | DESCRIPTION |
   +--------------------------------+-------------+
   | admin                          |             |
   | compute.images.user            |             |
   | editor                         |             |
   | ...                            |             |
   +--------------------------------+-------------+
   

4. Find out the user ID from the login or email address.

   yc iam user-account get test-user
   

   Result:

   id: gfei8n54hmfh********
   yandex_passport_user_account:
     login: test-user
     default_email: test-user@yandex.ru
   

5. Assign the user a role for the folder. In the subject, specify the userAccount type and user ID:

   yc resource-manager folder add-access-binding my-folder \
     --role editor \
     --subject userAccount:gfei8n54hmfh********
   

   Where:

   • --role: ID of the role you need to assign.

   • --subject: Subject getting the role.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and the corresponding CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

To assign a role to a service account, user group, or system group instead of a user, see these examples.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. Describe the roles you are assigning in the configuration file:

   Here is an example of the configuration file structure:

   data "yandex_resourcemanager_folder" "project1" {
     folder_id = "<folder_ID>"
   }
   
   resource "yandex_resourcemanager_folder_iam_member" "editor" {
     folder_id = "${data.yandex_resourcemanager_folder.project1.id}"
     role      = "editor"
     member    = "userAccount:<user_ID>"
   }
   

   Where:

   • folder_id: ID of the folder to grant permissions for. This is a required setting.

   • role: Role you need to assign. In one yandex_resourcemanager_folder_iam_member resource, only one role can be assigned.

   • member: Subject getting the role. This is a required setting.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   For more on the properties of the yandex_resourcemanager_folder_iam_member in Terraform, see this provider guide.

2. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   This will assign access permissions for the folder.

Use the updateAccessBindings REST API method for the Folder resource or the FolderService/UpdateAccessBindings gRPC API call. You will need the IDs of the folder and the user you are assigning a role for the folder to.

1. Find out the folder ID using the list REST API method:

   curl \
     --header "Authorization: Bearer <IAM_token>" \
     https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders?cloudId=<cloud_ID>
   

   Result:

   {
    "folders": [
     {
      "id": "b1g66mft1vop********",
      "cloudId": "b1gd129pp9ha********",
      "createdAt": "2018-10-17T12:44:31Z",
      "name": "my-folder",
      "status": "ACTIVE"
     }
    ]
   }
   

2. Find out the user ID by login using the getByLogin REST API method:

   curl \
     --header "Authorization: Bearer <IAM_token>" \
     https://iam.api.cloud.yandex.net/iam/v1/yandexPassportUserAccounts:byLogin?login=test-user
   

   Result:

   {
    "id": "gfei8n54hmfh********",
    "yandexPassportUserAccount": {
     "login": "test-user",
     "defaultEmail": "test-user@yandex.ru"
    }
   }
   

3. Assign the user a role for the folder. In the action property, enter ADD and specify the userAccount type and user ID under subject:

   curl \
     --request POST \
     --header 'Content-Type: application/json' \
     --header "Authorization: Bearer <IAM_token>" \
     --data '{
       "accessBindingDeltas": [
         {
           "action": "ADD",
           "accessBinding": {
             "roleId": "<role>",
             "subject": {
               "id": "<user_ID>",
               "type": "userAccount"
             }
           }
         }
       ]
     }' \
     https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/<folder_ID>:updateAccessBindings
   

   Where:

   • roleId: Role.

   • subject: Subject getting the role.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

     subject.type	subject.id
     userAccount	<user_ID>
     serviceAccount	<service_account_ID>
     federatedUser	<user_ID>
     group	<group_ID>
     system	allAuthenticatedUsers (All authenticated users group)
     	allUsers (All users group)
     	group:organization:<organization_ID>:users (All users in organization X group)
     	group:federation:<federation_ID>:users (All users in federation N group)
     	group:userpool:<pool_ID>:users (All users in userpool P group)

The add-access-binding command allows you to add only one role. You can assign multiple roles using the set-access-bindings command.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

1. Make sure the resource has no important roles assigned before proceeding:

   yc resource-manager folder list-access-bindings <folder_name_or_ID>
   

2. To assign a role, run this command:

   yc resource-manager folder set-access-bindings <folder_name_or_ID> \
     --access-binding role=<role>,subject=<subject_type>:<subject_ID>
   

   Where:

   • role: ID of the role you need to assign.

   • subject: Subject getting the role.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   Provide a separate --access-binding parameter for each role. Here is an example:

   yc resource-manager folder set-access-bindings my-folder \
     --access-binding role=editor,subject=userAccount:gfei8n54hmfh******** \
     --access-binding role=viewer,subject=userAccount:helj89sfj80a********
   

To assign a role to a service account, user group, or system group instead of a user, see these examples.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. Describe the folder access permissions in the configuration file.

   Here is an example of the configuration file structure:

   data "yandex_resourcemanager_folder" "project1" {
     folder_id = "<folder_ID>"
   }
   
   resource "yandex_resourcemanager_folder_iam_member" "member1" {
     folder_id = "${data.yandex_resourcemanager_folder.project1.id}"
     role      = "<role_1>"
     member    = "userAccount:<user_ID>"
   }
   
   resource "yandex_resourcemanager_folder_iam_member" "member2" {
     folder_id = "${data.yandex_resourcemanager_folder.project1.id}"
     role      = "<role_2>"
     member    = "userAccount:<user_ID>"
   }
   

   Where:

   • folder_id: ID of the folder to grant permissions for. This is a required setting.

   • role: Role you need to assign. In one yandex_resourcemanager_folder_iam_member resource, only one role can be assigned.

   • member: Subject getting the role. This is a required setting.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

2. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   This will assign access permissions for the folder.

Assign roles to the users:

curl \
  --request POST \
  --header 'Content-Type: application/json' \
  --header "Authorization: Bearer <IAM_token>" \
  --data '{
    "accessBindingDeltas": [
      {
        "action": "ADD",
        "accessBinding": {
          "roleId": "<role_1>",
          "subject": {
            "id": "<user_ID>",
            "type": "userAccount"
          }
        }
      },
      {
        "action": "ADD",
        "accessBinding": {
          "roleId": "<role_2>",
          "subject": {
            "id": "<user_ID>",
            "type": "userAccount"
          }
        }
      }
    ]
  }' \
  https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/<folder_ID>:updateAccessBindings

Where:

• roleId: Role.

• subject: Subject getting the role.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)

You can also assign roles using the setAccessBindings REST API method for the Folder resource or the FolderService/SetAccessBindings gRPC API call.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

1. Select the role to assign to the service account. You can find the description of the roles in the Yandex Identity and Access Management documentation in the Yandex Cloud role reference.

2. Find out the service account ID by its name:

   yc iam service-account get <service_account_name>
   

   Result:

   id: aje6o61dvog2********
   folder_id: b1gvmob95yys********
   created_at: "2018-10-15T18:01:25Z"
   name: my-robot
   

   If you don't know the name of the service account, get a list of service accounts with their IDs:

   yc iam service-account list
   

   Result:

   +----------------------+------------------+-----------------+
   |          ID          |       NAME       |   DESCRIPTION   |
   +----------------------+------------------+-----------------+
   | aje6o61dvog2******** | my-robot         | my description  |
   +----------------------+------------------+-----------------+
   

3. Assign the role to the service account using its ID:

   yc resource-manager folder add-access-binding <folder_name_or_ID> \
     --role <role> \
     --service-account-id <service_account_ID>
   

   Where:

   • --role: ID of the role you need to assign.
   • --service-account-id: Service account ID. You can also use the --service-account-name parameter and specify the username instead of the ID.

If you do not have Terraform yet, install it and configure the Yandex Cloud provider.

To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), authenticate using the appropriate method.

1. Assign the editor role to the service account:

   data "yandex_resourcemanager_folder" "project1" {
     folder_id = "<folder_ID>"
   }
   
   resource "yandex_resourcemanager_folder_iam_member" "editor" {
     folder_id = "${data.yandex_resourcemanager_folder.project1.id}"
     role      = "editor"
     member    = "serviceAccount:<service_account_ID>"
   }
   

   Where:

   • folder_id: Folder ID.

   • role: Role you need to assign.

   • member: Subject getting the role. For a service account, specify serviceAccount:<service_account_ID>.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

2. Create the resources:

   1. In the terminal, navigate to the configuration file directory.

   2. Make sure the configuration is correct using this command:

      terraform validate
      

      If the configuration is valid, you will get this message:

      Success! The configuration is valid.
      

   3. Run this command:

      terraform plan
      

      You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

   4. Apply the configuration changes:

      terraform apply
      

   5. Type yes and press Enter to confirm the changes.

   This will assign access permissions for the folder.

To assign the service account a role for a cloud or folder, use the updateAccessBindings REST API method for the Cloud or Folder resource:

1. Select the role to assign to the service account. You can find the description of the roles in the Yandex Identity and Access Management documentation in the Yandex Cloud role reference.

2. Get the ID of the service accounts folder.

3. Get an IAM token for authentication in the Yandex Cloud API.

4. Get a list of folder service accounts to find out their IDs:

   export FOLDER_ID=<folder_ID>
   export IAM_TOKEN=<IAM_token>
   curl \
     --header "Authorization: Bearer ${IAM_TOKEN}" \
     "https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts?folderId=${FOLDER_ID}"
   

   Result:

   {
    "serviceAccounts": [
     {
      "id": "ajebqtreob2d********",
      "folderId": "b1gvmob95yys********",
      "createdAt": "2018-10-18T13:42:40Z",
      "name": "my-robot",
      "description": "my description"
     }
    ]
   }
   

5. Create the request body, e.g., in the body.json file. Specify ADD in the action property:

   {
     "accessBindingDeltas": [{
       "action": "ADD",
       "accessBinding": {
         "roleId": "<role>",
         "subject": {
           "id": "<service_account_ID>",
           "type": "serviceAccount"
         }
       }
     }]
   }
   

   Where:

   • roleId: Role.

   • subject: Subject getting the role.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

     subject.type	subject.id
     userAccount	<user_ID>
     serviceAccount	<service_account_ID>
     federatedUser	<user_ID>
     group	<group_ID>
     system	allAuthenticatedUsers (All authenticated users group)
     	allUsers (All users group)
     	group:organization:<organization_ID>:users (All users in organization X group)
     	group:federation:<federation_ID>:users (All users in federation N group)
     	group:userpool:<pool_ID>:users (All users in userpool P group)

6. Assign a role to a service account. For example, for a folder with the b1gvmob95yys******** ID:

   export FOLDER_ID=b1gvmob95yys********
   export IAM_TOKEN=CggaAT********
   curl \
     --request POST \
     --header "Content-Type: application/json" \
     --header "Authorization: Bearer ${IAM_TOKEN}" \
     --data '@body.json' \
     "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:updateAccessBindings"
   

1. Select a role from the Yandex Cloud role reference.

2. Get the user ID.

3. Assign a role using this command:

   yc resource-manager folder add-access-binding <folder_name_or_ID> \
       --role <role_ID> \
       --subject federatedUser:<user_ID>
   

   Where:

   • <folder_name_or_ID>: Folder name or ID.

   • --role: Role ID, e.g., editor.

   • --subject: Subject getting the role.

     Subject designations

     To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and the corresponding CLI parameters:

     Subject type	Subject designation	Yandex Cloud CLI parameter
     userAccount	userAccount:<user_ID>	--user-account-id or --user-yandex-login
     serviceAccount	serviceAccount:<service_account_ID>	--service-account-id or --service-account-name
     federatedUser	federatedUser:<user_ID>	--user-account-id
     group	group:<group_ID>	--group-members
     system	system:allAuthenticatedUsers (All authenticated users group)	--all-authenticated-users
     	system:allUsers (All users group)	—
     	system:group:organization:<organization_ID>:users (All users in organization X group)	--organization-users
     	system:group:federation:<federation_ID>:users (All users in federation N group)	--federation-users
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)	—

   For example, assign the editor role to the aje6o61dvog2******** federated user for my-folder:

   yc resource-manager folder add-access-binding my-folder \
       --role editor \
       --subject federatedUser:aje6o61dvog2********