Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Getting started with Yandex Security Deck

Written by
Improved by
Updated at November 9, 2026
View in Markdown

Security Deck offers tools for data security and compliance with regulatory requirements and industry standards.

Getting started

To get started with Security Deck in Yandex Cloud:

  1. If you have not signed up to Yandex Cloud yet, go to the management console and follow the instructions.

  2. In Yandex Cloud Billing, make sure you have a billing account linked and its status is ACTIVE or TRIAL_ACTIVE. If you do not have a billing account yet, create one.

  3. If you do not have a folder yet, create one.

  4. Make sure you have the necessary permissions to work with the Security Deck modules. You optimal roles are:

    • security-deck.admin for the folder to contain Security Deck resources and modules.
    • auditor for the organization, cloud, or folder security in which will be controlled by the workspace.

  5. Create a service account and assign to it the security-deck.worker role for the organization, cloud, or folder security in which will be controlled by the workspace.

Create a Security Deck workspace

A workspace is a container holding the Security Deck module settings and resources, a list of controlled resources, control parameters, and other settings. Workspaces allow for more granular management of Yandex Cloud infrastructure security.

To create your first Security Deck workspace:

  1. Go to Yandex Security Deck.
  2. In the left-hand panel, select Workspace and click Create workspace.

  3. In the window that opens, select Creating and configuring workspace in the Main parameters section:

    1. Under Workspace name, enter a name for the new workspace. Follow these naming requirements:

      • It must be from 1 to 63 characters long.
      • It may contain lowercase Latin letters, numbers, and hyphens.
      • It must start with a letter and cannot end with a hyphen.

      Provide a brief description for the new workspace, if required.

    2. Under Resource storage folder, select the folder to store Security Deck resources for the new workspace.

      For security reasons, we recommend storing Security Deck resources in a separate cloud and folder restricted only to security staff.

      Note

      Once the workspace is created, you cannot change this folder.

    3. Under Payment for resources, add a billing account to use to pay for security module resources the workspace consumes.

    4. Under Alert sink, select the alert sink to receive all alerts generated in the workspace.

      Tip

      You can skip creating an alert sink. To do this, click Create and continue.
      A sink named default will be created automatically.

      Create a new alert sink if needed. Do it by clicking Create sink. In the window that opens, enter enter a name for the sink Create.

    5. Click Create and continue to proceed to the next step and configure the workspace resources.

  4. In the Resources section that opens:

    1. Under Workspace resources, select the connector to use in the workspace being created to access the controlled resources.

      If needed, create a new connector:

      1. Click Create connector, and in the window that opens:

        1. In the Name field, enter a name for the connector.

        2. Optionally, give the connector's description in the Description field.

        3. Select the service account for access to cloud resources in the Service account field.

          In the section below, you can see which resources the selected service account has access to.

          Make sure to assign the security-deck.worker role to this service account for the resources controlled in the workspace being created.

        4. Click Create connector.

    2. In the connector section that appears, click Select cloud/catalog to select the resources (clouds and folders) whose security will be managed in the new workspace:

      1. Select the resources whose security you want to manage in the workspace. You can only select the resources that are accessible to the previously selected service account.
      2. Click Save selection.

    3. Click Save and continue.

  5. In the Control modules section that opens:

    1. Optionally, activate additional Security Deck modules that you need in your environment.

    2. Optionally, expand the Configuration Monitoring (CSPM) and KSPM modules (if the latter is enabled) and select the industry standards and regulations to benchmark the resources you selected at the previous step against.

      You can select several standards at the same time. The Sets of requirements section will display the selected standards and regulations against which the environment’s resources will be checked.

    3. Click Save and continue.

  6. Optionally, in the Access bindings section that opens, add users who will have access to the workspace being created and assign them roles in this workspace:

    1. Click Add participants and in the window that opens:

      1. Select the user from the list. If required, use the search bar.
      2. In the window that opens, click Add role and select the role you want to assign to the user. You can assign multiple roles.
      3. Click Save.

    2. Click Finish to complete creating the Security Deck workspace.

    You do not have to add additional users to the workspace. In this case, the workspace will only be available to its creator.

Yandex Security Deck modules

Security Deck includes the following modules:

To use any of the modules, navigate to the Security Deck interface and select the module you need in the left-hand panel. On the page that opens, you can learn more about the tool's features and terms of use. To use the module you select, complete the required setup.

Data Security Posture Management (DSPM)

Data Security Posture Management, or DSPM, quickly detects sensitive information stored in Yandex Object Storage buckets and Yandex Disks in Yandex 360 for timely action to protect it from unauthorized access or leaks (through access policies, data anonymization, etc.).

A key feature of DSPM is automatic analysis of all data stored in buckets within a given environment. The analysis starts as soon as an environment is created and scans all bucket data.

These insights help you more accurately identify which resources may contain sensitive data and provide you with a data source for your next detailed scanning. Identifying sensitive data this way takes less time than scanning a manually created data source.

Note

Data analysis is billed separately from data source scans.

To get started with DSPM, activate it in the current Security Deck workspace settings and follow the guides on how to analyze data, create a data source, and create a scan for the information.

For more information, see Data Security Posture Management (DSPM).

Kubernetes® Security Posture Management (KSPM)

Kubernetes® Security Posture Management (KSPM) ensures the security of containerized applications.

The KSPM module automatically detects all Kubernetes clusters and containers within a given workspace and installs their security components as per the configuration. New clusters automatically get security coverage, without requiring manual search or installation of any components. For the KSPM components to be installed, the clusters must satisfy system and technical requirements.

The module continuously assesses workloads for misconfigurations and provides runtime security monitoring through sensors that detect attacks targeting nodes and containers.

Access Analyzer

Security Deck Access Analyzer is a tool providing a centralized view of the full list of accesses to the organization's resources available to subjects, i.e., users, service accounts, user groups, system groups, and public groups. The tool also makes it easy to revoke excessive access permissions from subjects. For more information, see Access Analyzer module.

To get started with the Access Analyzer module, follow the guides for viewing and revoking accesses.

Cloud Security Posture Management (CSPM)

Cloud Security Posture Management (CSPM) is a tool that monitors infrastructure security level based on security standards, such as Yandex Cloud's Cloud Infrastructure Security Standard.

In a given workspace, Cloud Security Posture Management (CSPM) checks the cloud infrastructure and applications deployed on the Yandex Cloud platform for compliance with comprehensive security requirements and best practices. The module's rules and exceptions help ensure compliance with security policies and protection against common threats and vulnerabilities in the cloud environment.

Threat Detector (TD)

The Threat Detector (TD) module is the first line of defense of the user's cloud infrastructure in Yandex Security Deck, which automatically detects suspicious activity and notifies the user about detected threats.

Threat Detector analyzes the audit events found in the client's infrastructure and registered using Yandex Audit Trails. The module does not require you to configure rules or involve security experts; it activates automatically when you set up your Security Deck workspace.

Each time a rule is triggered by a potential security threat, Security Deck generates an alert with detailed information about the event and recommendations for how to remove the threat. You can analyze the alert and find a solution with the help of the AI assistant, which will drill down on the problem and propose some remedies.

Vulnerability Management

Vulnerability Management enables you to centrally manage container image vulnerability scanning and view resource scan results within your workspace. This module supports scanning images from Container Registry and Cloud Registry, and those running in Managed Service for Kubernetes clusters.

Scanning can start automatically when the image is pushed to the registry, on a schedule, or when the image is used in a Kubernetes cluster. The module is integrated with KSPM to detect active images and inform you which vulnerable images are used in the monitored workspace.

For more information, see About Vulnerability Management (VM).

Access Transparency

Access Transparency is an automated tool you can use to view analytical data about actions by Yandex Cloud engineers involving the organization's resources, whether when processing requests, addressing security issues, or during maintenance.

The tool ensures operations are transparent and provides control over actions by Yandex Cloud engineers: a specially trained YandexGPT-based model automatically analyzes their action logs and escalates issues, if any, so that a Yandex Cloud information security specialist can check the session.

To connect and use Access Transparency, your organization must be linked to a billing account. Follow this guide to link your organization to a billing account.

Once your organization links a billing account, select it in the Access Transparency module.

For more information, see Access Transparency.

What's next

Next
All guides