[Yandex Cloud documentation](../../index.md) > [Yandex Certificate Manager](../index.md) > Access management

# Access management in Certificate Manager

In this section, you will learn about the following:
* [Resources you can assign a role for](#resources).
* [Roles existing in this service](#roles-list).
* [Roles required](#choosing-roles) for specific actions.

## Access management {#about-access-control}

[Yandex Identity and Access Management](../../iam/index.md) checks all operations in Yandex Cloud. If an entity does not have required permissions, IAM returns an error.


To grant permissions for a resource, [assign](../../iam/operations/roles/grant.md) the relevant resource roles to an entity performing operations. You can assign roles to a [Yandex account](../../iam/concepts/users/accounts.md#passport), [service account](../../iam/concepts/users/service-accounts.md), [local user](../../iam/concepts/users/accounts.md#local), [federated user](../../iam/concepts/federations.md), [user group](../../organization/operations/manage-groups.md), [system group](../../iam/concepts/access-control/system-group.md), or [public group](../../iam/concepts/access-control/public-group.md). For more information, see [How access management works in Yandex Cloud](../../iam/concepts/access-control/index.md).

To assign a role for a resource, you need the `certificate-manager.admin` role or one of the following roles for that resource:

* `admin`
* `resource-manager.admin`
* `organization-manager.admin`
* `resource-manager.clouds.owner`
* `organization-manager.organizations.owner`

## Resources you can assign a role for {#resources}

You can assign a role to an [organization](../../organization/concepts/organization.md), [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). The roles assigned to organizations, clouds, and folders also apply to their nested resources.

You can assign a role for a [Let's Encrypt certificate](../concepts/managed-certificate.md) or [custom certificate](../concepts/imported-certificate.md) via the Yandex Cloud [CLI](../../cli/cli-ref/certificate-manager/cli-ref/certificate/add-access-binding.md), [Terraform](../../terraform/resources/cm_certificate_iam_binding.md), or the [API](../api-ref/authentication.md).

## Roles existing in this service {#roles-list}

The chart below shows service’s roles and their permission inheritance. For example, `editor` inherits all `viewer` permissions. You can find role descriptions below the chart.

```mermaid
flowchart BT
    certificate-manager.editor --> certificate-manager.admin
    certificate-manager.certificates.downloader ----> certificate-manager.admin
    certificate-manager.viewer --> certificate-manager.editor
    certificate-manager.auditor --> certificate-manager.viewer
```

### Service roles {#service-roles}

#### certificate-manager.auditor {#certificate-manager-auditor}

The `certificate-manager.auditor` role enables viewing info on certificates and access permissions assigned to them.

Users with this role can:
* View the list of [certificates](../concepts/index.md#types) and [dependent](../concepts/services.md) resources, as well as info on certificates and [access permissions](../../iam/concepts/access-control/index.md) assigned to them.
* View info on the Certificate Manager [quotas](../concepts/limits.md#certificate-manager-quotas).

#### certificate-manager.viewer {#certificate-manager-viewer}

The `certificate-manager.viewer` role enables viewing info on certificates and access permissions assigned to them.

Users with this role can:
* View the list of [certificates](../concepts/index.md#types) and [dependent](../concepts/services.md) resources, as well as info on certificates and [access permissions](../../iam/concepts/access-control/index.md) assigned to them.
* View info on the Certificate Manager [quotas](../concepts/limits.md#certificate-manager-quotas).

This role includes the `certificate-manager.auditor` permissions.

#### certificate-manager.editor {#certificate-manager-editor}

The `certificate-manager.editor` role enables managing certificates and viewing info on them, as well as on access permissions assigned to them, and on the Certificate Manager quotas.

Users with this role can:
* View the list of [certificates](../concepts/index.md#types) and [dependent](../concepts/services.md) resources, as well as info on certificates and [access permissions](../../iam/concepts/access-control/index.md) assigned to them.
* Add, modify, update, and delete certificates.
* View info on the Certificate Manager [quotas](../concepts/limits.md#certificate-manager-quotas).

This role includes the `certificate-manager.viewer` permissions.

#### certificate-manager.admin {#certificate-manager-admin}

The `certificate-manager.admin` role enables managing certificates and access to them, as well as getting the certificate contents.

Users with this role can:
* View the list of [certificates](../concepts/index.md#types) and [dependent](../concepts/services.md) resources, as well as info on certificates.
* View info on [access permissions](../../iam/concepts/access-control/index.md) assigned to certificates and modify such permissions.
* Add, modify, update, and delete certificates.
* Get certificate contents.
* View info on the Certificate Manager [quotas](../concepts/limits.md#certificate-manager-quotas).
* View info on the relevant [folder](../../resource-manager/concepts/resources-hierarchy.md#folder).

This role includes the `certificate-manager.editor` permissions.

#### certificate-manager.certificates.downloader {#certificate-manager-certificates-downloader}

The `certificate-manager.certificates.downloader` role enables viewing the list of [certificates](../concepts/index.md#types) and info on them, as well as getting the certificate contents.

### Primitive roles {#primitive-roles}

Primitive roles allow users to perform actions in all Yandex Cloud [services](../../overview/concepts/services.md).

#### auditor {#auditor}

The `auditor` role grants a permission to read configuration and metadata of any Yandex Cloud resources without any access to data.

For instance, users with this role can:
* View info on a [resource](../../resource-manager/concepts/resources-hierarchy.md).
* View the resource metadata.
* View the list of operations with a resource.

`auditor` is the most secure role that does not grant any access to the [service](../../overview/concepts/services.md) data. This role suits the users who need minimum access to the Yandex Cloud resources.

#### viewer {#viewer}

The `viewer` role grants the permissions to read the info on any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md).

This role includes the `auditor` permissions.

Unlike `auditor`, the `viewer` role provides access to [service](../../overview/concepts/services.md) data in read mode.

#### editor {#editor}

The `editor` role provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md), except for assigning roles to other users, transferring [organization](../../organization/concepts/organization.md) ownership, removing an organization, and deleting Key Management Service [encryption keys](../../kms/concepts/index.md).

For instance, users with this role can create, modify, and delete resources.

This role includes the `viewer` permissions.

#### admin {#admin}

The `admin` role enables assigning any roles, except for `resource-manager.clouds.owner` and `organization-manager.organizations.owner`, and provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md) (except for transferring [organization](../../organization/concepts/organization.md) ownership and removing an organization).

Prior to assigning the `admin` role for an organization, [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [billing account](../../billing/concepts/billing-account.md), make sure to check out the information on protecting [privileged accounts](../../security/standard/all.md#privileged-users).

This role includes the `editor` permissions.

Instead of primitive roles, we recommend using service roles with more granular access control, allowing you to implement the [least privilege principle](../../security/standard/all.md#min-privileges).

For more information on primitive roles, see the [Yandex Cloud role reference](../../iam/roles-reference.md#primitive-roles).

## Required roles {#choosing-roles}

The table below lists the roles required for specific actions. You can always assign a role with more permissions, e.g., `editor` instead of `viewer`.

Action | Methods | Required roles
----- | ----- | -----
**Certificate Manager** | | 
Getting lists of certificates | `list` | `viewer` for a folder
Getting certificate details | `get` | `viewer` for a certificate or folder
[Adding](../operations/managed/cert-create.md) a Let's Encrypt certificate | `requestNew` | `editor` for a folder
[Updating](../operations/managed/cert-modify.md) or [deleting](../operations/managed/cert-delete.md) a Let's Encrypt certificate | `update`, `delete` | `editor` for a certificate or folder
[Adding](../operations/import/cert-create.md) a custom certificate | `create` | `editor` for a folder
[Renewing](../operations/import/cert-update.md), [updating](../operations/import/cert-modify.md), or [deleting](../operations/import/cert-delete.md) a custom certificate | `update`, `delete` | `editor` for a certificate or folder
Getting the contents of a [custom certificate](../operations/import/cert-get-content.md) or [Let's Encrypt certificate](../operations/managed/cert-get-content.md) | `get-content` | `certificate-manager.certificates.downloader` for a certificate or folder
**IAM** | |
[Assigning a role](../../iam/operations/roles/grant.md), [revoking a role](../../iam/operations/roles/revoke.md), and viewing the roles assigned for a folder or cloud | `setAccessBinding`, `updateAccessBindings`, `listAccessBindings` | `admin` or `certificate-manager.admin` for a certificate or folder 

#### What's next {what-is-next}

* [How to assign a role](../../iam/operations/roles/grant.md).
* [How to revoke a role](../../iam/operations/roles/revoke.md).
* [Learn more about access management in Yandex Cloud](../../iam/concepts/access-control/index.md).
* [Learn more about role inheritance](../../resource-manager/concepts/resources-hierarchy.md#access-rights-inheritance).