[Yandex Cloud documentation](../../../index.md) > [Yandex Compute Cloud](../../index.md) > [Concepts](../index.md) > [Instance groups](index.md) > Access

# Access

By default, all operations in Instance Groups are performed under a [service account](../../../iam/concepts/users/service-accounts.md).

Service accounts are special accounts that can be used by services and applications to work with other Yandex Cloud APIs on your behalf. For more information about service accounts and access management in Yandex Cloud, see the [Yandex Identity and Access Management documentation](../../../iam/index.md).

Instance Groups use the service account's [authorized keys](../../../iam/concepts/authorization/key.md) to authenticate in the APIs and perform operations on resources within the roles granted to the service account. For example, Instance Groups can use a service account to create, update, and delete VM instances.

An instance group may only have one service account created in the same folder as the group.

To enable a service account to create, modify, run, restart, stop, or delete VM instances in a group, you need to [assign](../../../iam/operations/sa/assign-role-for-sa.md) this service account the [compute.editor](../../security/index.md#compute-editor) role for the folder where you want to place your instance group.

If you want to integrate an instance group with a [Yandex Network Load Balancer](../../../network-load-balancer/index.md), you also need to assign the [load-balancer.editor](../../../network-load-balancer/security/index.md#load-balancer-editor) role to the service account.

To integrate an instance group with an L7 load balancer from [Yandex Application Load Balancer](../../../application-load-balancer/index.md), assign the [alb.editor](../../../application-load-balancer/security/index.md#alb-editor) role to the service account.

For more information, see [Integrating an instance group with Network Load Balancer or Application Load Balancer](balancers.md).

{% note info %}

You cannot delete a service account used to manage an instance group while it is linked to this group. First, [update](../../operations/instance-groups/update.md) the service account in the instance group settings or [delete](../../operations/instance-groups/delete.md) the instance group and then delete the service account.

{% endnote %}

## Use cases {#examples}

* [Running an autoscaling instance group](../../tutorials/vm-autoscale/index.md)

#### See also {#see-also}

- [Creating an instance group](../../quickstart/ig.md)
- [Creating a service account](../../../iam/operations/sa/create.md)
- [Creating a fixed-size instance group with a network load balancer](../../operations/instance-groups/create-with-balancer.md)
- [Creating a fixed-size instance group with an L7 load balancer](../../operations/instance-groups/create-with-load-balancer.md)