[Yandex Cloud documentation](../../index.md) > [Yandex Compute Cloud](../index.md) > Access management # Access management in Compute Cloud In this section, you will learn about: * [About access management in Yandex Cloud](#about-access-control). * [Resources you can assign a role for](#resources). * [Roles this service has](#roles-list). * [What roles are required to perform specific actions](#choosing-roles). ## Access management {#about-access-control} [Yandex Identity and Access Management](../../iam/index.md) checks all operations in Yandex Cloud. If an entity does not have required permissions, IAM returns an error. To grant permissions for a resource, [assign](../../iam/operations/roles/grant.md) the relevant resource roles to an entity performing operations. You can assign roles to a [Yandex account](../../iam/concepts/users/accounts.md#passport), [service account](../../iam/concepts/users/service-accounts.md), [local user](../../iam/concepts/users/accounts.md#local), [federated user](../../iam/concepts/federations.md), [user group](../../organization/operations/manage-groups.md), [system group](../../iam/concepts/access-control/system-group.md), or [public group](../../iam/concepts/access-control/public-group.md). For more information, see [How access management works in Yandex Cloud](../../iam/concepts/access-control/index.md). To assign a role for a resource, you need the `compute.admin` role or one of the following roles for that resource: * `admin` * `resource-manager.admin` * `organization-manager.admin` * `resource-manager.clouds.owner` * `organization-manager.organizations.owner` {% note info %} To create, modify, and edit a [VM](../concepts/vm.md), you need the `compute.editor` _minimum_ [role](index.md#compute-editor) for the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). To create a VM with a licensed image, you will additionally need the `license-manager.viewer` [role](../../marketplace/security/index.md#license-manager-viewer). To create a VM with a [public IP address](../../vpc/concepts/address.md#public-addresses), you will additionally need the `vpc.publicAdmin` [role](../../vpc/security/index.md#vpc-public-admin). {% endnote %} ## Which resources you can assign a role for {#resources} You can assign a role to an [organization](../../organization/concepts/organization.md), [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). The roles assigned to organizations, clouds, and folders also apply to their nested resources. You can also assign roles for individual resources within the service: {% list tabs group=instructions %} - Management console {#console} Use the [management console](https://console.yandex.cloud) to assign roles for the following resources: # Compute Cloud resources for which you can assign roles * [VM instance](../operations/vm-control/vm-access.md) * [Instance group](../operations/instance-groups/access.md) * [Dedicated host group](../operations/dedicated-host/access.md) * [VM placement group](../operations/placement-groups/access.md) * [Non-replicated disk placement group](../operations/disk-placement-groups/access.md) * [VM disk](../operations/disk-control/disk-access.md) * [GPU cluster](../operations/gpu-cluster/access.md) * [Image](../operations/image-control/access.md) * [Snapshot schedule](../operations/snapshot-control/snapshot-schedule-access.md) * [Disk snapshot](../operations/snapshot-control/snapshot-access.md) * [File storage](../operations/filesystem/filesystem-access.md) - CLI {#cli} You can use the [Yandex Cloud CLI](../../cli/cli-ref/compute/cli-ref/index.md) to assign roles for the following resources: # Compute Cloud resources for which you can assign roles * [VM instance](../operations/vm-control/vm-access.md) * [Instance group](../operations/instance-groups/access.md) * [Dedicated host group](../operations/dedicated-host/access.md) * [VM placement group](../operations/placement-groups/access.md) * [Non-replicated disk placement group](../operations/disk-placement-groups/access.md) * [VM disk](../operations/disk-control/disk-access.md) * [GPU cluster](../operations/gpu-cluster/access.md) * [Image](../operations/image-control/access.md) * [Snapshot schedule](../operations/snapshot-control/snapshot-schedule-access.md) * [Disk snapshot](../operations/snapshot-control/snapshot-access.md) * [File storage](../operations/filesystem/filesystem-access.md) - Terraform {#tf} Use [Terraform](../../terraform/index.md) to assign roles for the following resources: # Compute Cloud resources you can assign roles for using Terraform * [VM instance](../operations/vm-control/vm-access.md) * [VM placement group](../operations/placement-groups/access.md) * [Non-replicated disk placement group](../operations/disk-placement-groups/access.md) * [VM disk](../operations/disk-control/disk-access.md) * [GPU cluster](../operations/gpu-cluster/access.md) * [Image](../operations/image-control/access.md) * [Snapshot schedule](../operations/snapshot-control/snapshot-schedule-access.md) * [Disk snapshot](../operations/snapshot-control/snapshot-access.md) * [File storage](../operations/filesystem/filesystem-access.md) - API {#api} You can use the [Yandex Cloud](../api-ref/authentication.md) API to assign roles for the following resources: # Compute Cloud resources for which you can assign roles * [VM instance](../operations/vm-control/vm-access.md) * [Instance group](../operations/instance-groups/access.md) * [Dedicated host group](../operations/dedicated-host/access.md) * [VM placement group](../operations/placement-groups/access.md) * [Non-replicated disk placement group](../operations/disk-placement-groups/access.md) * [VM disk](../operations/disk-control/disk-access.md) * [GPU cluster](../operations/gpu-cluster/access.md) * [Image](../operations/image-control/access.md) * [Snapshot schedule](../operations/snapshot-control/snapshot-schedule-access.md) * [Disk snapshot](../operations/snapshot-control/snapshot-access.md) * [File storage](../operations/filesystem/filesystem-access.md) {% endlist %} ## Roles this service has {#roles-list} The chart below shows service’s roles and their permission inheritance. For example, `editor` inherits all `viewer` permissions. You can find role descriptions below the chart. ```mermaid %%{init: {"flowchart": {'defaultRenderer': 'elk'}} }%% flowchart BT iam.serviceAccounts.user vpc.user --> compute.editor compute.snapshotSchedules.viewer --> compute.viewer compute.snapshotSchedules.viewer --> compute.snapshotSchedules.editor compute.auditor --> compute.viewer compute.viewer --> compute.operator compute.snapshotSchedules.editor --> compute.editor compute.operator --> compute.editor compute.viewer --> compute.editor compute.disks.user --> compute.editor compute.images.user --> compute.editor compute.osLogin --> compute.editor compute.osLogin --> compute.osAdminLogin compute.editor --> compute.admin compute.osAdminLogin --> compute.admin ``` ### Service roles {#service-roles} #### compute.auditor {#compute-auditor} The `compute.auditor` role allows you to view information on Compute Cloud resources and relevant operations, as well as on the amount of used resources and quotas. It does not allow you to access the serial port or serial console of an instance. {% cut "Users with this role can:" %} * View a list of [instances](../concepts/vm.md) and information on them. * View a list of [instance groups](../concepts/instance-groups/index.md) and information on them. * View a list of [instance placement groups](../concepts/placement-groups.md) and information on them. * View lists of instances in placement groups. * View a list of [dedicated host groups](../concepts/dedicated-host.md#host-group-size) and information on them. * View lists of [hosts](../concepts/dedicated-host.md) and instances in dedicated host groups. * View information on [GPU clusters](../concepts/gpus.md#gpu-clusters) and instances included in these clusters. * View a list of [disks](../concepts/disk.md) and information on them. * View a list of [file storages](../concepts/filesystem.md) and information on them. * View a list of [non-replicated disk placement groups](../concepts/disk-placement-group.md) and information on them. * View lists of disks in placement groups. * View information on [reserved instance pools](../concepts/reserved-pools.md). * View a list of [images](../concepts/image.md) and information on them. * View information on [image families](../concepts/image.md#family), on images within families, on the latest family image, as well as on [access permissions](../../iam/concepts/access-control/index.md) assigned to image families. * View a list of [disk snapshots](../concepts/snapshot.md) and information on them. * View information on disk snapshot [schedules](../concepts/snapshot-schedule.md). * View information on Compute Cloud resource and [quota](../concepts/limits.md#compute-quotas) consumption and [disk limits](../concepts/limits.md#compute-limits-disks) in the management console. * View lists of resource operations for Compute Cloud, as well as information on these operations. * View information on the status of configuring access via [OS Login](../../organization/concepts/os-login.md) on instances. * View information on available [platforms](../concepts/vm-platforms.md). * View a list of [availability zones](../../overview/concepts/geo-scope.md) and information on them. {% endcut %} #### compute.viewer {#compute-viewer} The `compute.viewer` role allows you to view information on Compute Cloud resources and resource operations, as well as on access permissions assigned to the resources and on the amount of used resources and quotas. This role also grants access to instance metadata and serial port output. {% cut "Users with this role can:" %} * View the instance [serial port output](../operations/vm-info/get-serial-port-output.md). * View instance [metadata](../concepts/vm-metadata.md). * View a list of [instances](../concepts/vm.md), information on instances and on [access permissions](../../iam/concepts/access-control/index.md) assigned to them. * View a list of [instance groups](../concepts/instance-groups/index.md) and information on them. * View a list of [instance placement groups](../concepts/placement-groups.md), information on instance placement groups and on access permissions assigned to them. * View lists of instances in placement groups. * View a list of [dedicated host groups](../concepts/dedicated-host.md#host-group-size), information on dedicated host groups and on access permissions assigned to them. * View lists of [hosts](../concepts/dedicated-host.md) and instances in dedicated host groups. * View information on [GPU clusters](../concepts/gpus.md#gpu-clusters) and instances included in GPU clusters, as well as the on access permissions assigned to these clusters. * View a list of [disks](../concepts/disk.md), information on disks and on access permissions assigned to them. * View a list of [file storages](../concepts/filesystem.md), information on file storages and on access permissions assigned to them. * View a list of [non-replicated disk placement groups](../concepts/disk-placement-group.md), information on non-replicated disk placement groups and on access permissions assigned to them. * View lists of disks in placement groups. * View information on [reserved instance pools](../concepts/reserved-pools.md). * View a list of [images](../concepts/image.md), information on images and on access permissions assigned to them. * View information on [image families](../concepts/image.md#family), on images within families, on the latest family image, as well as on access permissions assigned to image families. * View a list of [disk snapshots](../concepts/snapshot.md), information on disk snapshots and on access permissions assigned to them. * View information on [disk snapshot schedules](../concepts/snapshot-schedule.md) and on access permissions assigned to them. * View information on Compute Cloud resource and [quota](../concepts/limits.md#compute-quotas) consumption and [disk limits](../concepts/limits.md#compute-limits-disks) in the management console. * View lists of resource operations for Compute Cloud, as well as information on these operations. * View information on the status of configuring access via [OS Login](../../organization/concepts/os-login.md) on instances. * View information on available [platforms](../concepts/vm-platforms.md). * View a list of [availability zones](../../overview/concepts/geo-scope.md), information on availability zones and on access permissions assigned to them. {% endcut %} This role includes the `compute.auditor` and `compute.snapshotSchedules.viewer` permissions. #### compute.editor {#compute-editor} The `compute.editor` role allows you to manage instances, instance groups, disks, images, GPU clusters, and other Compute Cloud resources. {% cut "Users with this role can:" %} * Create, modify, start, restart, stop, move, and delete [instances](../concepts/vm.md). * View a list of instances, information on instances and on [access permissions](../../iam/concepts/access-control/index.md) assigned to them. * Connect and disconnect disks, file storages, and network interfaces to and from instances, as well as link [security groups](../../vpc/concepts/security-groups.md) to instance network interfaces. * Create instances with custom [FQDNs](../../vpc/concepts/address.md#fqdn) and create multi-interface instances. * Bind [service accounts](../../iam/concepts/users/service-accounts.md) to instances and activate AWS v1 tokens on instances. * Use the instance [serial port](../operations/vm-info/get-serial-port-output.md) for reading and writing. * Simulate instance maintenance events. * View instance [metadata](../concepts/vm-metadata.md). * View information on the status of configuring access via [OS Login](../../organization/concepts/os-login.md) on instances and connect to instances via OS Login using SSH certificates or SSH keys. * View a list of [instance groups](../concepts/instance-groups/index.md), information on instance groups and on access permissions assigned to them, as well as use, create, modify, start, stop, and delete instance groups. * View a list of [instance placement groups](../concepts/placement-groups.md), information on instance placement groups and on access permissions assigned to them, as well as use, modify, and delete instance placement groups. * View lists of instances in placement groups. * View a list of [dedicated host groups](../concepts/dedicated-host.md#host-group-size), information on dedicated host groups and on access permissions assigned to them, as well as use, modify, and delete dedicated host groups. * View lists of [hosts](../concepts/dedicated-host.md) and instances in dedicated host groups. * Modify scheduled maintenance windows for hosts in dedicated host groups. * Use [GPU clusters](../concepts/gpus.md#gpu-clusters), as well as create, modify, and delete them. * View information on GPU clusters and instances included in GPU clusters, as well as the on access permissions assigned to these clusters. * View information on [reserved instance pools](../concepts/reserved-pools.md), as well as create, use, modify, and delete them. * View a list of [disks](../concepts/disk.md), information on disks and on access permissions assigned to them, as well as use, modify, move, and delete disks. * Create [encrypted disks](../concepts/disk.md#encryption). * View and update disk links. * View a list of [file storages](../concepts/filesystem.md), information on file storages and on access permissions assigned to them, as well as use, create, modify, and delete file storages. * View a list of [non-replicated disk placement groups](../concepts/disk-placement-group.md), information on non-replicated disk placement groups and on access permissions assigned to them, as well as use, modify, and delete non-replicated disk placement groups. * View lists of disks in placement groups. * View a list of [images](../concepts/image.md), information on images and on access permissions assigned to them, as well as use, modify, and delete images. * Create, modify, delete, and update [image families](../concepts/image.md#family). * View information on image families, on images within families, on the latest family image, as well as on access permissions assigned to image families. * View a list of [disk snapshots](../concepts/snapshot.md), information on disk snapshots and on access permissions assigned to them, as well as use, modify, and delete disk snapshots. * View information on disk snapshot [schedules](../concepts/snapshot-schedule.md) and on access permissions assigned to them, as well as create, modify, and delete disk snapshot schedules. * View information on [cloud networks](../../vpc/concepts/network.md#network) and use them. * View information on [subnets](../../vpc/concepts/network.md#subnet) and use them. * View information on [cloud resource addresses](../../vpc/concepts/address.md) and use them. * View information on [route tables](../../vpc/concepts/routing.md#rt-vpc) and use them. * View information on security groups and use them. * View information on [NAT gateways](../../vpc/concepts/gateways.md) and connect them to route tables. * View information on the IP addresses used in subnets. * View information on resource operations for Virtual Private Cloud. * View information on Virtual Private Cloud [quotas](../../vpc/concepts/limits.md#vpc-quotas). * View information on Compute Cloud resource and [quota](../concepts/limits.md#compute-quotas) consumption and [disk limits](../concepts/limits.md#compute-limits-disks) in the management console. * View lists of resource operations for Compute Cloud and information on operations, as well as abort such operations. * View information on available [platforms](../concepts/vm-platforms.md) and use them. * View a list of [availability zones](../../overview/concepts/geo-scope.md), information on availability zones and on access permissions assigned to them. * View information on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud). * View information on the relevant [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). {% endcut %} This role includes the `compute.operator`, `compute.osLogin`, `compute.snapshotSchedules.editor`, `compute.disks.user`, and `vpc.user` permissions. {% note warning %} Starting August 1, 2026, the `compute.editor` role gets new permissions allowing it to connect VM instances to [Yandex Cloud Backup](../../backup/index.md), link and unlink them from [backup policies](../../backup/concepts/policy.md). If you do not plan to connect your resources to Cloud Backup and do not want to grant such permissions to your users, you can proactively disable these features using the `backup.denyActivation` [authorization policy](../../iam/concepts/access-control/access-policies.md#backup-denyActivation) assigned to your folder, cloud, or organization. For more information on how to create an authorization policy, see [Creating an access policy for a resource](../../iam/operations/access-policies/assign.md). {% endnote %} #### compute.admin {#compute-admin} The `compute.admin` role allows you to manage instances, instance groups, disks, images, GPU clusters, and other Compute Cloud resources, as well as manage access to them. {% cut "Users with this role can:" %} * Create, modify, start, restart, stop, move, and delete [instances](../concepts/vm.md), as well as manage access to them. * View a list of instances, information on instances and on [access permissions](../../iam/concepts/access-control/index.md) assigned to them. * Connect and disconnect disks, file storages, and network interfaces to and from instances, as well as link [security groups](../../vpc/concepts/security-groups.md) to instance network interfaces. * Create instances with custom [FQDNs](../../vpc/concepts/address.md#fqdn) and create multi-interface instances. * Bind [service accounts](../../iam/concepts/users/service-accounts.md) to instances and activate AWS v1 tokens on instances. * Use the instance [serial port](../operations/vm-info/get-serial-port-output.md) for reading and writing. * Simulate instance maintenance events. * View instance [metadata](../concepts/vm-metadata.md). * View information on the status of configuring access via [OS Login](../../organization/concepts/os-login.md) on instances and connect to instances via OS Login using SSH certificates or SSH keys and run commands as a superuser (`sudo`). * Use, create, modify, start, stop, and delete [instance groups](../concepts/instance-groups/index.md), as well as manage access to instance groups. * View a list of instance groups, information on instance groups and on access permissions assigned to them. * Use, create, modify, and delete [instance placement groups](../concepts/placement-groups.md), as well as manage access to instance placement groups. * View a list of instance placement groups, information on instance placement groups and on access permissions assigned to them. * View lists of instances in placement groups. * Use, create, modify, and delete [dedicated host groups](../concepts/dedicated-host.md#host-group-size), as well as manage access to dedicated host groups. * View a list of dedicated host groups, information on dedicated host groups and on access permissions assigned to them. * View lists of [hosts](../concepts/dedicated-host.md) and instances in dedicated host groups. * Modify scheduled maintenance windows for hosts in dedicated host groups. * Use, create, modify, and delete [GPU clusters](../concepts/gpus.md#gpu-clusters), as well as manage access to them. * View information on GPU clusters and instances included in GPU clusters, as well as the on access permissions assigned to these clusters. * View information on [reserved instance pools](../concepts/reserved-pools.md), as well as create, use, modify, and delete them. * Use, create, modify, move, and delete [disks](../concepts/disk.md), as well as manage access to them. * Create [encrypted disks](../concepts/disk.md#encryption). * View a list of disks, information on disks and on access permissions assigned to them. * View and update disk links. * Use, create, modify, and delete [file storages](../concepts/filesystem.md), as well as manage access to them. * View a list of file storages, information on file storages and on access permissions assigned to them. * Use, create, modify, and delete [non-replicated disk placement groups](../concepts/disk-placement-group.md), as well as manage access to non-replicated disk placement groups. * View a list of non-replicated disk placement groups, information on non-replicated disk placement groups and on access permissions assigned to them. * View lists of disks in placement groups. * Use, create, modify, and delete [images](../concepts/image.md), as well as manage access to them. * View a list of images, information on images and on access permissions assigned to them. * Create, modify, delete, and update [image families](../concepts/image.md#family), as well as manage access to them. * View information on image families, on images within families, on the latest family image, as well as on access permissions assigned to image families. * Use, create, modify, and delete [disk snapshots](../concepts/snapshot.md), as well as manage access to them. * View a list of disk snapshots, information on disk snapshots and on access permissions assigned to them. * Create, modify, and delete [disk snapshot schedules](../concepts/snapshot-schedule.md), as well as manage access to them. * View information on disk snapshot schedules and on access permissions assigned to them. * View information on [cloud networks](../../vpc/concepts/network.md#network) and use them. * View information on [subnets](../../vpc/concepts/network.md#subnet) and use them. * View information on [cloud resource addresses](../../vpc/concepts/address.md) and use them. * View information on [route tables](../../vpc/concepts/routing.md#rt-vpc) and use them. * View information on security groups and use them. * View information on [NAT gateways](../../vpc/concepts/gateways.md) and connect them to route tables. * View information on the IP addresses used in subnets. * View information on resource operations for Virtual Private Cloud. * View information on Virtual Private Cloud [quotas](../../vpc/concepts/limits.md#vpc-quotas). * View information on Compute Cloud resource and [quota](../concepts/limits.md#compute-quotas) consumption and [disk limits](../concepts/limits.md#compute-limits-disks) in the management console. * View lists of resource operations for Compute Cloud and information on operations, as well as abort such operations. * View information on available [platforms](../concepts/vm-platforms.md) and use them. * View a list of [availability zones](../../overview/concepts/geo-scope.md), information on availability zones and on access permissions assigned to them. * View information on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud). * View information on the relevant [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). {% endcut %} This role includes the `compute.editor` and `compute.osAdminLogin` permissions. {% note warning %} Starting August 1, 2026, the `compute.admin` role gets new permissions allowing it to connect VM instances to [Yandex Cloud Backup](../../backup/index.md), link and unlink them from [backup policies](../../backup/concepts/policy.md). If you do not plan to connect your resources to Cloud Backup and do not want to grant such permissions to your users, you can proactively disable these features using the `backup.denyActivation` [authorization policy](../../iam/concepts/access-control/access-policies.md#backup-denyActivation) assigned to your folder, cloud, or organization. For more information on how to create an authorization policy, see [Creating an access policy for a resource](../../iam/operations/access-policies/assign.md). {% endnote %} #### compute.osLogin {#compute-oslogin} The `compute.osLogin` role allows you to connect to [instances](../concepts/vm.md) via [OS Login](../../organization/concepts/os-login.md) using SSH certificates or SSH keys. #### compute.osAdminLogin {#compute-osadminlogin} The `compute.osAdminLogin` role allows you to connect to [instances](../concepts/vm.md) using SSH certificates or SSH keys via [OS Login](../../organization/concepts/os-login.md) and run commands as a superuser (`sudo`). {% note alert %} A user with [superuser](https://en.wikipedia.org/wiki/Superuser) permissions for a VM can retain access to it even if the [roles are revoked](../../organization/security/index.md#revoke). To prevent user access to a VM with old permissions, [create](../operations/images-with-pre-installed-software/create.md) a new VM from a clean image. {% endnote %} #### compute.disks.user {#compute-disks-user} The `compute.disks.user` role allows you to view a list of [disks](../concepts/disk.md) and information on them, as well as use disks to create new resources, such as [instances](../concepts/vm.md). #### compute.images.user {#compute-images-user} The `compute.images.user` role allows you to view a list of [images](../concepts/image.md) and information on them, get information on the latest image within the [image family](../concepts/image.md#family), as well as use images to create new resources, such as [instances](../concepts/vm.md). #### compute.operator {#compute-operator} The `compute.operator` role allows you to start and stop instances and instance groups, as well as view information on Compute Cloud resources and resource operations, as well as on access permissions assigned to the resources and the amount of used resources and quotas. {% cut "Users with this role can:" %} * Start, restart, and stop [instances](../concepts/vm.md). * View a list of instances, information on instances and on [access permissions](../../iam/concepts/access-control/index.md) assigned to them. * Start and stop [instance groups](../concepts/instance-groups/index.md). * View a list of instance groups and information on them. * View the instance [serial port output](../operations/vm-info/get-serial-port-output.md). * View instance [metadata](../concepts/vm-metadata.md). * View a list of [instance placement groups](../concepts/placement-groups.md), information on instance placement groups and on access permissions assigned to them. * View lists of instances in placement groups. * View a list of [dedicated host groups](../concepts/dedicated-host.md#host-group-size), information on dedicated host groups and on access permissions assigned to them. * View lists of [hosts](../concepts/dedicated-host.md) and instances in dedicated host groups. * View information on [GPU clusters](../concepts/gpus.md#gpu-clusters) and instances included in GPU clusters, as well as the on access permissions assigned to these clusters. * View a list of [disks](../concepts/disk.md), information on disks and on access permissions assigned to them. * View a list of [file storages](../concepts/filesystem.md), information on file storages and on access permissions assigned to them. * View a list of [non-replicated disk placement groups](../concepts/disk-placement-group.md), information on non-replicated disk placement groups and on access permissions assigned to them. * View lists of disks in placement groups. * View information on [reserved instance pools](../concepts/reserved-pools.md). * View a list of [images](../concepts/image.md), information on images and on access permissions assigned to them. * View information on [image families](../concepts/image.md#family), on images within families, on the latest family image, as well as on access permissions assigned to image families. * View a list of [disk snapshots](../concepts/snapshot.md), information on disk snapshots and on access permissions assigned to them. * View information on [disk snapshot schedules](../concepts/snapshot-schedule.md) and on access permissions assigned to them. * View information on Compute Cloud resource and [quota](../concepts/limits.md#compute-quotas) consumption and [disk limits](../concepts/limits.md#compute-limits-disks) in the management console. * View lists of resource operations for Compute Cloud, as well as information on these operations. * View information on the status of configuring access via [OS Login](../../organization/concepts/os-login.md) on instances. * View information on available [platforms](../concepts/vm-platforms.md). * View a list of [availability zones](../../overview/concepts/geo-scope.md), information on availability zones and on access permissions assigned to them. {% endcut %} This role includes the `compute.viewer` permissions. #### compute.snapshotSchedules.viewer {#compute-snapshotSchedules-viewer} The `compute.snapshotSchedules.viewer` role allows you to view information on scheduled disk snapshots. Users with this role can: * View information on disk snapshot [schedules](../concepts/snapshot-schedule.md) and on [access permissions](../../iam/concepts/access-control/index.md) assigned to them. * View lists of [disks](../concepts/disk.md). * View lists of [disk snapshots](../concepts/snapshot.md). * View a list of disk snapshot operations. #### compute.snapshotSchedules.editor {#compute-snapshotSchedules-editor} The `compute.snapshotSchedules.editor` role allows you to create, modify, and delete disk snapshot schedule, create and delete disk snapshots, as well as view information on disk snapshot operations. Users with this role can: * View information on disk snapshot [schedules](../concepts/snapshot-schedule.md) and on [access permissions](../../iam/concepts/access-control/index.md) assigned to them, as well as create, modify, and delete disk snapshot schedules. * View lists of [disks](../concepts/disk.md) and use disks to create snapshots. * View lists of [disk snapshots](../concepts/snapshot.md), create and delete snapshots. * View a list of disk snapshot operations and information on them. This role includes the `compute.snapshotSchedules.viewer` permissions. #### iam.serviceAccounts.user {#iam-serviceAccounts-user} The `iam.serviceAccounts.user` role enables viewing the list of service accounts and info on them, as well as performing operations on behalf of a service account. For example, if you specify a [service account](../../iam/concepts/users/accounts.md#sa) when creating an instance group, IAM will check whether you have a permission to use this service account. For more information about service roles, see [Roles](../../iam/concepts/access-control/roles.md) in the Yandex Identity and Access Management guides. ### Primitive roles {#primitive-roles} Primitive roles allow users to perform actions in all Yandex Cloud [services](../../overview/concepts/services.md). #### auditor {#auditor} The `auditor` role grants a permission to read configuration and metadata of any Yandex Cloud resources without any access to data. For instance, users with this role can: * View info on a [resource](../../resource-manager/concepts/resources-hierarchy.md). * View the resource metadata. * View the list of operations with a resource. `auditor` is the most secure role that does not grant any access to the [service](../../overview/concepts/services.md) data. This role suits the users who need minimum access to the Yandex Cloud resources. #### viewer {#viewer} The `viewer` role grants the permissions to read the info on any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md). This role includes the `auditor` permissions. Unlike `auditor`, the `viewer` role provides access to [service](../../overview/concepts/services.md) data in read mode. #### editor {#editor} The `editor` role provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md), except for assigning roles to other users, transferring [organization](../../organization/concepts/organization.md) ownership, removing an organization, and deleting Key Management Service [encryption keys](../../kms/concepts/index.md). For instance, users with this role can create, modify, and delete resources. This role includes the `viewer` permissions. #### admin {#admin} The `admin` role enables assigning any roles, except for `resource-manager.clouds.owner` and `organization-manager.organizations.owner`, and provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md) (except for transferring [organization](../../organization/concepts/organization.md) ownership and removing an organization). Prior to assigning the `admin` role for an organization, [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [billing account](../../billing/concepts/billing-account.md), make sure to check out the information on protecting [privileged accounts](../../security/standard/all.md#privileged-users). This role includes the `editor` permissions. Instead of primitive roles, we recommend using service roles with more granular access control, allowing you to implement the [least privilege principle](../../security/standard/all.md#min-privileges). For more information on primitive roles, see the [Yandex Cloud role reference](../../iam/roles-reference.md#primitive-roles). ## Required roles {#choosing-roles} The table below lists the roles required for specific actions. You can always assign a role offering more permissions than the specified one. For example, you can assign the `editor` role instead of `compute.editor`, or the `compute.viewer` role for a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) instead of a separate VM or disk. Action | Minimum required roles ----- | ----- **Viewing data** | Viewing information about any resource and [access permissions](../../iam/concepts/access-control/index.md) assigned to any resource | `compute.viewer` for the resource Viewing the list of [VM instances](../concepts/vm.md) in an [instance group](../concepts/instance-groups/index.md), viewing instance group logs | `compute.viewer` for the instance group Viewing the list of [disks](../concepts/disk.md) in a [disk placement group](../concepts/disk-placement-group.md) | `compute.viewer` for the disk placement group Viewing the list of VM instances in a [GPU cluster](../concepts/gpus.md#gpu-clusters) | `compute.viewer` for the GPU cluster Viewing the list of virtual machines on a [dedicated host](../concepts/dedicated-host.md), viewing the list of dedicated hosts in a dedicated host group | `compute.viewer` for the dedicated host group Viewing a list of virtual machines in a [placement group](../concepts/placement-groups.md) | `compute.viewer` for the placement group [Getting the VM serial port output](../operations/vm-info/get-serial-port-output.md) | `compute.viewer` for the instance Getting info about the the most relevant [image](../concepts/image.md) in an [image family](../concepts/image.md#family) | `compute.viewer` or `compute.images.user` for the image Viewing information about disk [snapshot](../concepts/snapshot.md) [schedules](../concepts/snapshot-schedule.md), viewing the list of disks attached to a specific disk snapshot schedule and the list of disk snapshots created based this schedule | `compute.snapshotSchedules.viewer` or `compute.viewer` for the schedule **Use of resources** | Using any resource | `compute.editor` for this resource Use of [disks](../concepts/disk.md) | `compute.disks.user`, `compute.snapshotSchedules.editor`, or `compute.editor` for the disk Use of [images](../concepts/image.md) | `compute.images.user` or `compute.editor` for the image **Managing resources** | [Creating](../operations/vm-create/create-linux-vm.md) a VM | `compute.editor` for the folder Creating a VM with a [public IP address](../../vpc/concepts/address.md#public-addresses) | `compute.editor` and `vpc.publicAdmin` for the folder [Starting](../operations/vm-control/vm-stop-and-start.md#start), [stopping](../operations/vm-control/vm-stop-and-start.md#stop), and [restarting](../operations/vm-control/vm-stop-and-start.md#restart) virtual machines | `compute.operator` for the VM instance [Modifying](../operations/vm-control/vm-update.md) and [deleting](../operations/vm-control/vm-delete.md) a virtual machine | `compute.editor` for the VM instance [Linking](../operations/vm-control/vm-connect-sa.md) a service account to a VM | `compute.editor` for the VM instance [Changing VM metadata](../operations/vm-metadata/update-vm-metadata.md) | `compute.editor` for the VM instance [Attaching](../operations/vm-control/vm-attach-disk.md)/[detaching](../operations/vm-control/vm-detach-disk.md) a disk to/from a VM | `compute.editor` for the instance [Attaching](../operations/filesystem/attach-to-vm.md)/[detaching](../operations/filesystem/detach-from-vm.md) a [file storage](../concepts/filesystem.md) to/from a VM | `compute.editor` for the VM instance [Adding](../operations/vm-control/attach-network-interface.md) a [network interface](../concepts/network.md) to a VM and [deleting](../operations/vm-control/detach-network-interface.md) it from a VM, modifying a VM network interface | `compute.editor` for the instance [Assigning](../operations/vm-control/vm-attach-public-ip.md) a [public IP address](../../vpc/concepts/address.md#public-addresses) to a VM and [unassigning](../operations/vm-control/vm-detach-public-ip.md) it from a VM | `compute.editor` for the instance [Assigning](../operations/vm-control/vm-change-security-groups-set.md) [security groups](../../vpc/concepts/security-groups.md) to a VM | `compute.editor` for the VM instance Moving a VM [to another cloud folder](../operations/vm-control/vm-change-folder.md) | `compute.editor` for the VM instance [Simulating](../operations/vm-control/vm-update-policies.md#simulate) an instance maintenance event | `compute.editor` for the VM instance [Creating](../operations/instance-groups/create-fixed-group.md) an instance group | `compute.editor` for the folder [Starting](../operations/instance-groups/start.md) and [stopping](../operations/instance-groups/stop.md) an instance group | `compute.operator` for the instance group [Changing](../operations/instance-groups/update.md) and [deleting](../operations/instance-groups/delete.md) an instance group | `compute.editor` for the instance group Sequential [restarting](../operations/instance-groups/rolling-restart.md) and [recreating](../operations/instance-groups/rolling-recreate.md) instances in a group | `compute.operator` for the instance group [Pausing](../operations/instance-groups/pause-processes.md) and [resuming](../operations/instance-groups/resume-processes.md) instance group processes | `compute.editor` for the instance group [Creating](../operations/gpu-cluster/gpu-cluster-create.md) a GPU cluster | `compute.editor` for the folder [Updating](../operations/gpu-cluster/gpu-cluster-update.md) and [deleting](../operations/gpu-cluster/gpu-cluster-delete.md) a GPU cluster | `compute.editor` for the GPU cluster [Creating](../operations/dedicated-host/create-host-group.md) a group of dedicated hosts | `compute.editor` for the folder Updating and deleting a group of dedicated hosts, updating hosts in a group of dedicated hosts | `compute.editor` for the dedicated host group [Creating](../operations/reserved-pools/create-reserved-pool.md) a reserved instance pool | `compute.editor` for the folder [Updating](../operations/reserved-pools/update-reserved-pool.md) and [deleting](../operations/reserved-pools/delete-reserved-pool.md) a reserved instance pool | `compute.editor` for the folder [Creating](../operations/placement-groups/create.md) a placement group | `compute.editor` for the folder Changing and [deleting](../operations/placement-groups/delete.md) a placement group | `compute.editor` for the placement group [Creating](../operations/disk-placement-groups/create.md) a disk placement group | `compute.editor` for the folder Changing and deleting a disk placement group | `compute.editor` for the disk placement group [Creating](../operations/disk-create/empty.md) a disk | `compute.editor` for the folder [Updating](../operations/disk-control/update.md) and [deleting](../operations/disk-control/delete.md) a disk | `compute.editor` for the disk Moving a disk to a [different cloud folder](../operations/disk-control/disk-change-folder.md) | `compute.editor` for the disk [Creating](../operations/filesystem/create.md) a file storage | `compute.editor` for the folder [Updating](../operations/filesystem/update.md) and [deleting](../operations/filesystem/delete.md) a file storage | `compute.editor` for the file storage [Creating](../operations/image-create/create-from-disk.md) an image | `compute.editor` for the folder Updating and [deleting](../operations/image-control/delete.md) an image | `compute.editor` for the image [Creating](../operations/disk-control/create-snapshot.md) a disk snapshot | `compute.snapshotSchedules.editor` or `compute.editor` for the folder [Deleting](../operations/snapshot-control/delete.md) a disk snapshot | `compute.snapshotSchedules.editor` or `compute.editor` for the disk snapshot [Creating](../operations/snapshot-control/create-schedule.md) a disk snapshot schedule | `compute.snapshotSchedules.editor` or `compute.editor` for the folder [Starting](../operations/snapshot-control/stop-and-start-schedule.md#start-schedule), [stopping](../operations/snapshot-control/stop-and-start-schedule.md#stop-schedule), [updating](../operations/snapshot-control/update-schedule.md) and [deleting](../operations/snapshot-control/delete-schedule.md) a disk snapshot schedule | `compute.snapshotSchedules.editor` or `compute.editor` for the schedule **Managing resource access** | [Assigning](../../iam/operations/roles/grant.md) and [revoking](../../iam/operations/roles/revoke.md) access permissions for any resource | `compute.admin` for this resource #### What's next {#what-is-next} * [How to assign a role](../../iam/operations/roles/grant.md). * [How to revoke a role](../../iam/operations/roles/revoke.md). * [Learn more about access management in Yandex Cloud](../../iam/concepts/access-control/index.md). * [Learn more about role inheritance](../../resource-manager/concepts/resources-hierarchy.md#access-rights-inheritance).