[Yandex Cloud documentation](../../../index.md) > [Yandex Cloud CDN](../../index.md) > [Step-by-step guides](../index.md) > Resources > Setting up access via a secure token

# Setting up access via a secure token

Using [secure tokens](../../concepts/secure-tokens.md), you can restrict access to [CDN resource](../../concepts/resource.md) files to only via [pre-signed URLs](../../concepts/secure-tokens.md#protected-link) with the limited validity period.

You can also use secure tokens to specify a trusted [IP address](../../../vpc/concepts/address.md) to access a CDN resource from.

### Enabling access {#enable-secure-token}

To enable access via a secure token:
1. Come up with a secret key that is a string of 6 to 32 characters. It will be saved in the CDN resource settings for generating pre-signed URLs.
1. On your website, set up [generation](../../concepts/secure-tokens.md#link-generation-code) of pre-signed URLs with secure tokens.
1. Enable access to the CDN resource via a secure token:

   {% list tabs group=instructions %}

   - Management console {#console}

     1. In the [management console](https://console.yandex.cloud), select the folder where your resource is located.
     1. Navigate to **Cloud CDN**.
     1. Click the resource name.
     1. In the top-right corner, click ![image](../../../_assets/console-icons/pencil.svg) **Edit**.
     1. Enable **Access via secure token**:

        * Specify a **Secret key** that is a string of 6 to 32 characters. You will need a secret key to generate [pre-signed URLs](../../concepts/secure-tokens.md#protected-link).
        
            You can view the secret key you saved in the management console or using the `yc cdn resource list` [CLI](../../../cli/index.md) command.
        * Use the **Limit access by IP address** field to restrict access to content by IP address:
        
           * `Only trusted IP addresses`: Access to files will be allowed only from a specific IP address of the content recipient. The IP address itself is provided outside the CDN resource and specified as a parameter when generating an [MD5](https://en.wikipedia.org/wiki/MD5) hash for a pre-signed URL.
           * `No restrictions`: Access to files will be allowed from any IP address.

     1. Click **Save**.

   - CLI {#cli}

     If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

     The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

     1. View the description of the [CLI](../../../cli/index.md) command to update a resource:

        ```bash
        yc cdn resource update --help
        ```

     1. Get a list of all resources in the default [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder):

        ```bash
        yc cdn resource list --format yaml
        ```

        Result:

        ```text
        id: bc8br5k6iohx********
        folder_id: b1gt6g8ht345********
        cname: testexample.com
        created_at: "2022-01-19T09:23:57.921365Z"
        updated_at: "2022-01-19T10:55:30.305141Z"
        active: true
        options:
          edge_cache_settings:
            enabled: true
            default value: "345600"
          cache_http_headers:
            enabled: true
            value:
            - content-type
            - content-length
            - connection
            - server
            - date
            - test
          stale:
            enabled: true
            value:
            - error
            - updating
          allowed_http_methods:
            value:
            - GET
            - POST
            - HEAD
            - OPTIONS
        origin_group_id: "89783"
        origin_group_name: My origins group
        origin_protocol: HTTP
        ssl_certificate:
          type: DONT_USE
          status: READY
        ```

        Save the `id` of the resource you want to set up access for via a secure token.
     1. Enable access via a secure token:

        ```bash
        yc cdn resource update \
          --id <resource_ID> \
          --secure-key <secret_key> \
          --enable-ip-url-signing
        ```

        Where:
        * `--id`: ID of the CDN resource you want to enable access for via a secure token.
        * `--secure-key`: Secret key you created.
        * `--enable-ip-url-signing`: Optional parameter that restricts access to the CDN resource by IP address. The trusted IP address itself is provided outside the CDN resource and specified as a parameter when generating an [MD5](https://en.wikipedia.org/wiki/MD5) hash for a pre-signed URL. If the parameter is not set, file access will be allowed from any IP address.

   - Terraform {#tf}

     If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
     
     
     To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

     1. Open the Terraform configuration file and add the following parameters to the section with the CDN resource description:

        ```hcl
        resource "yandex_cdn_resource" "my_resource" {
          ...
          options {
            ...
            secure_key = "<secret_key>"
            enable_ip_url_signing = true
          }
        }
        ```

        Where:
        * `secure_key`: Secret key you created.
        * `enable_ip_url_signing`: Optional parameter, `true` or `false`. It restricts access to the CDN resource by IP address. The trusted IP address itself is provided outside the CDN resource and specified as a parameter when generating an [MD5](https://en.wikipedia.org/wiki/MD5) hash for a pre-signed URL. If the parameter is not set, file access will be allowed from any IP address.

        For more information about the `yandex_cdn_resource` properties in Terraform, see the [provider documentation](../../../terraform/resources/cdn_resource.md).
     1. Apply the changes:

        1. In the terminal, navigate to the configuration file directory.
        1. Make sure the configuration is correct using this command:
        
           ```bash
           terraform validate
           ```
        
           If the configuration is valid, you will get this message:
        
           ```bash
           Success! The configuration is valid.
           ```
        
        1. Run this command:
        
           ```bash
           terraform plan
           ```
        
           You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
        1. Apply the configuration changes:
        
           ```bash
           terraform apply
           ```
        
        1. Type `yes` and press **Enter** to confirm the changes.

     You can check the updated CDN resource parameters using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/index.md) command:

     ```bash
     yc cdn resource get <resource_ID>
     ```

   - API {#api}

     Use the [update](../../api-ref/Resource/update.md) REST API method for the [Resource](../../api-ref/Resource/index.md) resource or the [ResourceService/Update](../../api-ref/grpc/Resource/update.md) gRPC API call.

    {% endlist %}

    It may take up to 15 minutes for the new settings of the existing resource to apply to the CDN servers. After that, we recommend [purging the resource cache](purge-cache.md).

    Enabling access to CDN resource content via a secure token disables access to it via regular links.

### Disabling access {#disable-secure-token}

To disable access to a CDN resource via a secure token:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where your resource is located.
  1. Navigate to **Cloud CDN**.
  1. Click the resource name.
  1. In the top-right corner, click ![image](../../../_assets/console-icons/pencil.svg) **Edit**.
  1. Disable **Access via secure token**.
  1. Click **Save**.

- CLI {#cli}

  Run this command:

  ```bash
  yc cdn resource update \
    --id <resource_ID> \
    --clear-secure-key
  ```

  Where:
  * `--id`: ID of the CDN resource you want to disable secure token access for.
  * `--clear-secure-key`: Parameter for disabling secure token access.

- Terraform {#tf}

  1. Open the Terraform configuration file and delete the `secure_key` and `enable_ip_url_signing` properties from the section with the CDN resource description:

     ```hcl
     resource "yandex_cdn_resource" "my_resource" {
       ...
       options {
         ...
         secure_key = "<secret_key>"
         enable_ip_url_signing = true
       }
     }
     ```

     For more information about the `yandex_cdn_resource` properties in Terraform, see [this provider guide](../../../terraform/resources/cdn_resource.md).
  1. Apply the changes:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

  You can check the updated CDN resource parameters using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/index.md) command:

  ```bash
  yc cdn resource get <resource_ID>
  ```

- API {#api}

  Use the [update](../../api-ref/Resource/update.md) REST API method for the [Resource](../../api-ref/Resource/index.md) resource or the [ResourceService/Update](../../api-ref/grpc/Resource/update.md) gRPC API call.

{% endlist %}

It may take up to 15 minutes for the new settings of the existing resource to apply to the CDN servers. After that, we recommend [purging the resource cache](purge-cache.md).