Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Access diagnostics in Access Analyzer

Written by
Updated at November 9, 2026
View in Markdown

Note

This feature is at the Preview stage.

Access Analyzer enables you to centrally view a list of subject and group access permissions for organization resources and revoke them as needed.

Viewing a list of a subject’s access permissions

Only organization members with the organization-manager.viewer role or higher for the organization can view access permissions in the Security Deck interface.

To get a list of a subject's accesses to the organization's resources:

  1. Log in as an organization user with the organization-manager.viewer role or higher for the organization.

  2. Go to Yandex Security Deck.

  3. On the left panel, select Access Analyzer, and at the top of the screen, select the workspace.

  4. Navigate to the Access diagnostics tab.

  5. Click Select subject and in the window that opens:

    1. Select the user, service account, user group, system group, or public group you need.

      Use search, if required.

    2. Click Select.

This will open a list of accesses assigned to the selected subject. For each access, the list indicates the resource name/ID and type, role assigned to the subject for that resource, and information about whether the role was assigned to the subject directly or inherited from a group to which the subject belongs.

If the selected subject has multiple accesses, only some of them will be displayed. To display the remaining access permissions, click Load more at the bottom of the page.

Use filtering by resource ID, role ID, or access assignment method (Directly appointed or Assigned via group) as needed.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command to get a list of subject’s accesses:

    yc iam access-analyzer list-subject-access-bindings --help

  2. Get the ID of a user, service account, or user group to view their list of accesses.

  3. Use the yc iam access-analyzer list-subject-access-bindings command to get a list of subject’s accesses:

    yc iam access-analyzer list-subject-access-bindings \
   --organization-id=<organization_ID> \
   --subject-id=<subject_ID>

    Where:

    Result:

    +---------+-------------------------+----------------------+----------+
| ROLE ID |      RESOURCE TYPE      |     RESOURCE ID      | GROUP ID |
+---------+-------------------------+----------------------+----------+
| admin   | resource-manager.cloud  | b1g2c5615qja******** |          |
| admin   | resource-manager.folder | b1gq979gqitb******** |          |
+---------+-------------------------+----------------------+----------+

    You will get the list of accesses as a table. For each access, the list indicates a role assigned to the subject for a resource as well as the resource type and ID. If the subject has not been assigned any role directly, but has inherited it from a group, the list will indicate the group ID.

Revoking subject’s access

Accesses can be revoked by a user with the admin, resource-manager.admin, organization-manager.admin, resource-manager.clouds.owner, or organization-manager.organizations.owner role, or with the admin role for the service to whose resource the subject’s access is being revoked.

To revoke a subject's access (role) for a resource:

  1. Open the list of the subject's accesses and select the one you want to revoke.

    Use filtering by resource ID, role ID, or access assignment method (Directly appointed or Assigned via group), if required.

  2. Revoke access based on the assignment method used:

    If access is assigned to the subject directly (the Group field is left blank):

    1. In the row with the access you need, click and select Revoke access.
    2. In the window that opens, verify info on the resource you are revoking access to and select the roles to revoke.
    3. Click Revoke all (or Revoke selected if you left some roles unselected).

    If access is assigned to the subject through a group (the Group field contains the group name and ID), such access cannot be revoked from the subject. Instead, you can either remove the subject from this user group or revoke the access from the whole group.

    • To remove a subject from a user group:

      1. In the row with the access, click and select Remove from group.
      2. In the window that opens, review the list of accesses the subject will lose when removed from the group, and click Remove.

      You cannot remove a subject from a system group or public group. To revoke access granted through one of these groups, you have to revoke that access from the whole group.

    • To revoke access from the whole group, open the list of accesses for that group and follow the guide on how to revoke directly assigned access.

Useful links

An organization is the highest resource in the Yandex Cloud resource model hierarchy that consolidates the resources of all other services. It is also used for user management as well as authentication and authorization management. For more information, see Organization.

Previous
Working with recommendations
Next
Overview