[Yandex Cloud documentation](../../../index.md) > [Yandex Compute Cloud](../../index.md) > [Step-by-step guides](../index.md) > Disk snapshots > Configuring snapshot schedule access permissions

# Configuring snapshot schedule access permissions

To grant a user, group, or [service account](../../../iam/concepts/users/service-accounts.md) access to a [disk snapshot schedule](../../concepts/snapshot-schedule.md), assign a [role](../../../iam/concepts/access-control/roles.md) for it.

## Assigning a role {#access-to-user}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder the schedule belongs to.
  1. Navigate to **Compute Cloud**.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/picture.svg) **Snapshots**.
  1. Navigate to the **Snapshot schedules** tab.
  1. Select the schedule from the list.
  1. Navigate to the ![image](../../../_assets/console-icons/persons.svg) **Access bindings** tab.
  1. Click **Assign roles**.
  1. In the window that opens, select the group, user, or service account you want to grant access to the schedule.
  1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the required [roles](../../security/index.md#roles-list).
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for assigning a role for a disk snapshot schedule:

     ```bash
     yc compute snapshot-schedule add-access-binding --help
     ```

  1. Get a list of schedules in the default [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder):

     ```bash
     yc compute snapshot-schedule list
     ```
     
     Result:
     
     ```text
     +----------------------+-----------------+--------+-------------+
     |          ID          |      NAME       | STATUS | DESCRIPTION |
     +----------------------+-----------------+--------+-------------+
     | fd85vvoeea6u******** | first-schedule  | ACTIVE |             |
     | fd14ogykea8j******** | second-schedule | ACTIVE |             |
     +----------------------+-----------------+--------+-------------+
     ```

  1. View the roles already assigned for the resource:

     ```bash
     yc compute snapshot-schedule list-access-bindings <schedule_ID>
     ```

  1. Assign a role using this command:

     * To a user:

       ```bash
       yc compute snapshot-schedule add-access-binding <schedule_ID> \
         --user-account-id <user_ID> \
         --role <role>
       ```

       Where:

       * `--user-account-id`: [User ID](../../../organization/operations/users-get.md).
       * `--role`: [Role](../../security/index.md#roles-list).

     * To a service account:

       ```bash
       yc compute snapshot-schedule add-access-binding <schedule_ID> \
         --service-account-id <service_account_ID> \
         --role <role>
       ```

       Where:

       * `--service-account-id`: [Service account ID](../../../iam/operations/sa/get-id.md).
       * `--role`: Role.

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  To assign a role for a schedule using Terraform:

  1. In the Terraform configuration file, describe the resources you want to create:

      ```hcl
      resource "yandex_compute_snapshot_schedule_iam_binding" "sa-access" {
        snapshot_schedule_id = "<schedule_ID>"
        role                 = "<role>"
        members              = ["<subject_type>:<subject_ID>","<subject_type>:<subject_ID>"]
      }
      ```

      Where:

      * `snapshot_schedule_id`: Schedule ID.
      * `role`: [Role](../../security/index.md#roles-list).
      * `members`: List of types and IDs of [subjects](../../../iam/concepts/access-control/index.md#subject) getting the role. Use this format: `userAccount:<user_ID>` or `serviceAccount:<service_account_ID>`.

      For more information about `yandex_compute_snapshot_schedule_iam_binding` properties, see [this provider guide](../../../terraform/resources/compute_snapshot_schedule_iam_binding.md).

  1. Create the resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

      Terraform will create all the required resources. You can check the new resources using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/index.md) command:

      ```bash
      yc compute snapshot-schedule list-access-bindings <schedule_ID>
      ```

- API {#api}

  Use the [updateAccessBindings](../../api-ref/SnapshotSchedule/updateAccessBindings.md) REST API method for the [SnapshotSchedule](../../api-ref/SnapshotSchedule/index.md) resource or the [SnapshotSchedule/UpdateAccessBindings](../../api-ref/grpc/SnapshotSchedule/updateAccessBindings.md) gRPC API call. In the request body, set the `action` property to `ADD` and specify the user type and ID under `subject`.

{% endlist %}

## Assigning multiple roles {#multiple-roles}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder the schedule belongs to.
  1. Navigate to **Compute Cloud**.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/picture.svg) **Snapshots**.
  1. Navigate to the **Snapshot schedules** tab.
  1. Select the schedule from the list.
  1. Navigate to the ![image](../../../_assets/console-icons/persons.svg) **Access bindings** tab.
  1. Click **Assign roles**.
  1. In the window that opens, select the group, user, or service account you want to grant access to the schedule.
  1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the required [roles](../../security/index.md#roles-list).
  1. To add another role, click **Add role**.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  You can assign multiple roles using the `set-access-bindings` command.

  {% note alert %}
  
  The `set-access-bindings` command completely rewrites access permissions for the resource. All current roles for the resource will be deleted.
  
  {% endnote %}

  1. Make sure the resource has no important roles assigned before proceeding:

     ```bash
     yc compute snapshot-schedule list-access-bindings <schedule_ID>
     ```

  1. See the description of the CLI command for assigning roles for a disk snapshot schedule:

     ```bash
     yc compute snapshot-schedule set-access-bindings --help
     ```

  1. Assign roles:

     ```bash
     yc compute snapshot-schedule set-access-bindings <schedule_ID> \
       --access-binding role=<role>,subject=<subject_type>:<subject_ID>
     ```

     Where:

     * `--access-binding`: Role:

       * `role`: Role ID.
       * `subject`: Type and ID of the [subject](../../../iam/concepts/access-control/index.md#subject) the role is assigned to.

     For example, this command will assign roles to multiple users and a single service account:

     ```bash
     yc compute snapshot-schedule set-access-bindings my-schedule \
       --access-binding role=editor,subject=userAccount:gfei8n54hmfh********
       --access-binding role=viewer,subject=userAccount:helj89sfj80a********
       --access-binding role=editor,subject=serviceAccount:ajel6l0jcb9s********
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  To assign multiple roles for a schedule using Terraform:

  1. In the Terraform configuration file, describe the resources you want to create:

      ```hcl
      resource "yandex_compute_snapshot_schedule_iam_binding" "role-1" {
        snapshot_schedule_id = "<schedule_ID>"
        role                 = "<role_1>"
        members              = ["<subject_type>:<subject_ID>"]
      }

      resource "yandex_compute_snapshot_schedule_iam_binding" "role-2" {
        snapshot_schedule_id = "<schedule_ID>"
        role                 = "<role_2>"
        members              = ["<subject_type>:<subject_ID>"]
      }
      ```

      Where:

      * `snapshot_schedule_id`: Schedule ID.
      * `role`: [Role](../../security/index.md#roles-list).
      * `members`: List of types and IDs of [subjects](../../../iam/concepts/access-control/index.md#subject) getting the role. Use this format: `userAccount:<user_ID>` or `serviceAccount:<service_account_ID>`.

      For more information about `yandex_compute_snapshot_schedule_iam_binding` properties, see [this provider guide](../../../terraform/resources/compute_snapshot_schedule_iam_binding.md).

  1. Create the resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

      You can check the updates using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/index.md) command:

      ```bash
      yc compute snapshot-schedule list-access-bindings <schedule_ID>
      ```

- API {#api}

  Use the [setAccessBindings](../../api-ref/SnapshotSchedule/setAccessBindings.md) REST API method for the [SnapshotSchedule](../../api-ref/SnapshotSchedule/index.md) resource or the [SnapshotSchedule/SetAccessBindings](../../api-ref/grpc/SnapshotSchedule/setAccessBindings.md) gRPC API call.

{% endlist %}

## Revoking a role {#revoke-role}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder the schedule belongs to.
  1. Navigate to **Compute Cloud**.
  1. In the left-hand panel, select ![image](../../../_assets/console-icons/picture.svg) **Snapshots**.
  1. Navigate to the **Snapshot schedules** tab.
  1. Select the schedule from the list.
  1. Navigate to the ![image](../../../_assets/console-icons/persons.svg) **Access bindings** tab.
  1. In the line with the user in question, click ![icon-context-menu](../../../_assets/console-icons/ellipsis.svg) and select **Edit roles**.
  1. Click ![cross](../../../_assets/console-icons/xmark.svg) next to a role to delete it.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for revoking a role for a disk snapshot schedule:

     ```bash
     yc compute snapshot-schedule remove-access-binding --help
     ```

  1. View the list of users and their roles for the resource:

     ```bash
     yc compute snapshot-schedule list-access-bindings <schedule_ID>
     ```

  1. To revoke access permissions, run this command:

      ```bash
      yc compute snapshot-schedule remove-access-binding <schedule_ID> \
        --role <role_ID> \
        --subject <subject_type>:<subject_ID>
      ```

      Where:

      * `--role`: ID of the role you need to revoke.
      * `--subject`: [Subject](../../../iam/concepts/access-control/index.md#subject) to revoke the role from.

      For example, this command revokes the `viewer` role for the schedule from a user with the `ajel6l0jcb9s********` ID:

      ```bash
      yc compute snapshot-schedule remove-access-binding my-schedule \
        --role viewer \
        --subject userAccount:ajel6l0jcb9s********
      ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  To revoke a role assigned for a disk snapshot schedule using Terraform:

  1. Open the Terraform configuration file and delete the fragment describing the role:

      ```hcl
      ...
      resource "yandex_compute_snapshot_schedule_iam_binding" "sa-access" {
        snapshot_schedule_id = "<schedule_ID>"
        role                 = "<role>"
        members              = ["<subject_type>:<subject_ID>"]
      }
      ```

  1. Apply the changes:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

      You can check the updates using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/quickstart.md) command:

      ```bash
      yc compute snapshot-schedule list-access-bindings <schedule_ID>
      ```

- API {#api}

  To revoke roles for a disk snapshot schedule, use the [updateAccessBindings](../../api-ref/SnapshotSchedule /updateAccessBindings.md) REST API method for the [SnapshotSchedule](../../api-ref/SnapshotSchedule/index.md) resource or the [SnapshotScheduleService/UpdateAccessBindings](../../api-ref/grpc/SnapshotSchedule/updateAccessBindings.md) gRPC API call. In the request body, set the `action` property to `REMOVE` and specify the user type and ID under `subject`.

{% endlist %}