[Yandex Cloud documentation](../../../index.md) > [Yandex Container Registry](../../index.md) > [Step-by-step guides](../index.md) > Working with roles > Revoking a role

# Revoking a role for a resource

You can prevent a [subject](../../../iam/concepts/access-control/index.md#subject) from accessing a resource. To do this, revoke the subject's [roles](../../../iam/concepts/access-control/roles.md) for that resource or the resources that the access rights are inherited from. For more information, see [How access management works in Yandex Cloud](../../../iam/concepts/access-control/index.md).

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to revoke a role for a resource.
  1. Navigate to **Container Registry**.
  1. Select a [registry](../../concepts/registry.md) or [repository](../../concepts/repository.md) in it.
  1. Navigate to the **Access bindings** tab.
  1. Select a user from the list and click ![image](../../../_assets/console-icons/ellipsis.svg) next to the username.
  1. Click **Edit roles**.
  1. Click ![image](../../../_assets/console-icons/xmark.svg) next to the role to revoke.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View assigned roles:

     ```bash
     yc container <resource> list-access-bindings <resource_name_or_ID>
     ```

     Where:
     * `<resource>`: `registry` or `repository` resource type.
     * `<resource_name_or_ID>`: Name or ID of the resource the role is assigned for.

  1. Revoke a role:
     
     * From a user:
       
       ```bash
       yc container <resource> remove-access-binding <resource_name_or_ID> \
         --role <role> \
         --user-account-id <user_ID>
       ```

     * From a [service account](../../../iam/concepts/users/service-accounts.md):
       
       ```bash
       yc container <resource> remove-access-binding <resource_name_or_ID> \
         --role <role> \
         --service-account-id <service_account_ID>
       ```

     * From all authenticated users (the `All authenticated users` [public group](../../../iam/concepts/access-control/public-group.md)):
       
       ```bash
       yc container <resource> remove-access-binding <resource_name_or_ID> \
         --role <role> \
         --all-authenticated-users
       ```

       Where:
       * `<resource>`: `registry` or `repository` resource type.
       * `<resource_name_or_ID>`: Name or ID of the resource you want to revoke the role for.
       * `<role_ID>`: [Role](../../security/index.md#service-roles) you want to revoke.
     
     **Example**

     The example below revokes the `container-registry.admin` role for `my-first-registry` from a user.
     
     ```bash
     yc container registry remove-access-binding my-first-registry \
       --role container-registry.admin \
       --user-account-id ajeugsk5ubk6********
     ```

     Result:

     ```text
     done (9s)
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. Open the Terraform configuration file and delete the fragment with the role assignment description.

     Example role assignment description in the Terraform configuration:

       ```
       resource "yandex_container_registry_iam_binding" "registry_name" {
         registry_id = "<registry_ID>"
         role        = "<role>"
       
         members = [
           "userAccount:<user_ID>",
         ]
       }
       ```

       For more on the properties of the `yandex_container_registry_iam_binding` resource, see [this provider guide](../../../terraform/resources/container_registry_iam_binding.md).
  
  1. 1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

  You can check whether the role has been revoked using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/quickstart.md) command:

     * Registry:

       ```bash
       yc container registry list-access-bindings <registry_name_or_ID>
       ```

     * Repository:

       ```bash
       yc container repository list-access-bindings <repository_name_or_ID>
       ```

- API {#api}

  [View](get-assigned-roles.md#cli) the roles assigned for resources.
  
  To revoke registry roles, use the [updateAccessBindings](../../api-ref/Registry/updateAccessBindings.md) REST API method for the [Registry](../../api-ref/Registry/index.md) resource or the [RegistryService/UpdateAccessBindings](../../api-ref/grpc/Registry/updateAccessBindings.md) gRPC API call.

  To revoke repository roles, use the [updateAccessBindings](../../api-ref/Repository/updateAccessBindings.md) REST API method for the [Repository](../../api-ref/Repository/index.md) resource or the [RepositoryService/UpdateAccessBindings](../../api-ref/grpc/Repository/updateAccessBindings.md) gRPC API call.

{% endlist %}

You can read more about role management in the Yandex Identity and Access Management [documentation](../../../iam/concepts/index.md).