[Yandex Cloud documentation](../../../index.md) > [Yandex Container Registry](../../index.md) > [Step-by-step guides](../index.md) > Working with roles > Assigning a role

# Assigning a role for a resource

To grant access to a [resource](../../../iam/concepts/access-control/resources-with-access-control.md), assign the subject a [role](../../../iam/concepts/access-control/roles.md) for the resource itself or a resource from which access permissions are inherited, e.g., a [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) or [cloud](../../../resource-manager/concepts/resources-hierarchy.md#cloud). For the current list of resources you can assign roles for, see [Which resources you can assign a role for](../../security/index.md#resources).

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you want to assign a role for a resource.
  1. Navigate to **Container Registry**.
  1. Select a [registry](../../concepts/registry.md) or [repository](../../concepts/repository.md) in it.
  1. Navigate to the **Access bindings** tab.
  1. Click **Assign roles**.
  1. In the window that opens, select a group, user, or [service account](../../../iam/concepts/users/service-accounts.md).
  1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the role from the list.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To assign a role for a resource, run the following command:

  * To a user:

    ```bash
    yc container <resource> add-access-binding <resource_name_or_ID> \
      --role <role> \
      --user-account-id <user_ID>
    ```

  * [To a service account](../../../iam/concepts/users/service-accounts.md):

    ```bash
    yc container <resource> add-access-binding <resource_name_or_ID> \
      --role <role> \
      --service-account-id <service_account_ID>
    ```

  * To all authenticated users (the `All authenticated users` [public group](../../../iam/concepts/access-control/public-group.md)):

    ```bash
    yc container <resource> add-access-binding <resource_name_or_ID> \
      --role <role> \
      --all-authenticated-users
    ```

    Where:
    * `<resource>`: `registry` or `repository` resource type.
    * `<resource_name_or_ID>`: Name or ID of the resource to assign the role for.
    * `<role>`: [Role](../../security/index.md#service-roles) you want to assign.
  
  **Example**

  In the example below, we are assigning the `container-registry.admin` role for `my-first-registry` to a user.

  ```bash
  yc container registry add-access-binding my-first-registry \
    --role container-registry.admin \
    --user-account-id ajeugsk5ubk6********
  ```

  Result:

  ```text
  done (4s)
  ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Describe the following in a configuration file:
     * The `yandex_container_registry_iam_binding` resource parameters to assign the role for the [registry](../../concepts/registry.md):

       ```
       resource "yandex_container_registry_iam_binding" "registry_name" {
         registry_id = "<registry_ID>"
         role        = "<role>"
       
         members = [
           "userAccount:<user_ID>",
         ]
       }
       ```

       Where:
       * `registry_id`: ID of the registry for which a role is being assigned. To find out the registry ID, [get a list of registries in the folder](../registry/registry-list.md#registry-list).
       * `role`: [Role](../../security/index.md#service-roles) you want to assign.
       * `members`: ID of the user, group, or service account to which you are assigning the role.
     
     * The `yandex_container_repository_iam_binding` resource parameters to assign the role for the [repository](../../concepts/repository.md):

       ```
       resource "yandex_container_repository_iam_binding" "repository_name" {
         repository_id = "<repository_ID>"
         role          = "<role>"
       
         members = [
           "serviceAccount:<service_account_ID>",
         ]
       }
       ```

       Where:
       * `repository_id`: ID of the repository for which you are assigning the role. To find out the ID of a repository, [get a list of repositories in the folder](../repository/repository-list.md#repository-list).
       * `role`: Role you want to assign.
       * `members`: ID of the user, group, or service account to which you are assigning the role.

     For more on the properties of the `yandex_container_repository_iam_binding` resource, see [this provider guide](../../../terraform/resources/container_repository_iam_binding.md).
  
  1. 1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

  You can check that the role has been assigned using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/quickstart.md) command:

     * Registry:

       ```bash
       yc container registry list-access-bindings <registry_name_or_ID>
       ```

     * Repository:

       ```bash
       yc container repository list-access-bindings <repository_name_or_ID>
       ```

- API {#api}

  Use the [updateAccessBindings](../../api-ref/Registry/updateAccessBindings.md) REST API method for the [Registry](../../api-ref/Registry/index.md) resource or the [RegistryService/UpdateAccessBindings](../../api-ref/grpc/Registry/updateAccessBindings.md) gRPC API call.

  Use the [updateAccessBindings](../../api-ref/Repository/updateAccessBindings.md) REST API method for the [Repository](../../api-ref/Repository/index.md) resource or the [RepositoryService/UpdateAccessBindings](../../api-ref/grpc/Repository/updateAccessBindings.md) gRPC API call.

{% endlist %}