Revoking roles assigned for a container

Written by

Yandex Cloud

Improved by

ilya

Updated at September 30, 2026

View in Markdown

CLI

API

Run this command to revoke a role for a container:

yc serverless container remove-access-binding \
  --name <container_name> \
  --role <role_ID> \
  --subject <subject_type>:<subject_ID>

Where:

--role: ID of the role you need to revoke.

--subject: Subject to revoke the role from.

Subject designations

To indicate a subject, use the --subject parameter in <subject_type>:<ID> format. For some subject types, the Yandex Cloud CLI provides separate parameters instead of --subject, where you only need to specify the subject name or ID without the type. Possible subject designations and matching CLI parameters:

Subject type	Subject designation	Yandex Cloud CLI parameter
`userAccount`	`userAccount:<user_ID>`	`--user-account-id` or `--user-yandex-login`
`serviceAccount`	`serviceAccount:<service_account_ID>`	`--service-account-id` or `--service-account-name`
`federatedUser`	`federatedUser:<user_ID>`	`--user-account-id`
`group`	`group:<group_ID>`	`--group-members`
`system`	`system:allAuthenticatedUsers` (`All authenticated users` group)	`--all-authenticated-users`
	`system:allUsers` (`All users` group)	—
	`system:group:organization:<organization_ID>:users` (`All users in organization X` group)	`--organization-users`
	`system:group:federation:<federation_ID>:users` (`All users in federation N` group)	`--federation-users`
	`system:group:userpool:<pool_ID>:users` (`All users in userpool P` group)	—

To revoke roles for a container, use the updateAccessBindings REST API method for the Container resource or the ContainerService/UpdateAccessBindings gRPC API call. In the request body, set the action property to REMOVE and specify the subject type and ID under subject.

Subject designations

To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Here are possible combinations:

subject.type	subject.id
`userAccount`	`<user_ID>`
`serviceAccount`	`<service_account_ID>`
`federatedUser`	`<user_ID>`
`group`	`<group_ID>`
`system`	`allAuthenticatedUsers` (`All authenticated users` group)
	`allUsers` (`All users` group)
	`group:organization:<organization_ID>:users` (`All users in organization X` group)
	`group:federation:<federation_ID>:users` (`All users in federation N` group)
	`group:userpool:<pool_ID>:users` (`All users in userpool P` group)

Revoking roles assigned for a container

Was the article helpful?