[Yandex Cloud documentation](../../index.md) > [Yandex Cloud DNS](../index.md) > [Step-by-step guides](index.md) > Zones > Configuring DNS zone access permissions

# Configuring DNS zone access permissions

Assign an appropriate [role](../../iam/concepts/access-control/roles.md) to a user, group, or [service account](../../iam/concepts/users/service-accounts.md) to provide [DNS zone](../concepts/dns-zone.md) access.

## Assigning a role {#add-access}

{% list tabs group=instructions %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for the DNS zone role assignment:

      ```bash
      yc dns zone add-access-binding --help
      ```

  1. Get a DNS zone list in the default [folder](../../resource-manager/concepts/resources-hierarchy.md#folder):

      ```bash
      yc dns zone list
      ```

  1. View the roles already assigned for the resource:

      ```bash
      yc dns zone list-access-bindings <zone_ID>
      ```

  1. Assign a role using this command:

      * To a user:

        ```bash
        yc dns zone add-access-binding <zone_ID> \
          --user-account-id <user_ID> \
          --role <role>
        ```

        Where:

        * `--user-account-id`: [User ID](../../organization/operations/users-get.md). Use the `--all-authenticated-users` flag to assign a role to all authenticated users.
        * `--role`: [Role](../security/index.md#roles-list) to assign.

      * To a service account:

        ```bash
        yc dns zone add-access-binding <zone_ID> \
          --service-account-id <service_account_ID> \
          --role <role>
        ```

        Where:

        * `--service-account-id`: [Service account ID](../../iam/operations/sa/get-id.md).
        * `--role`: [Role](../security/index.md#roles-list) to assign.

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To assign a role for a DNS zone using Terraform, do the following:

  1. In the Terraform configuration file, describe the resources you want to create:

      ```hcl
      resource "yandex_dns_zone_iam_binding" "zone-viewers" {
        dns_zone_id = "<zone_ID>"
        role        = "<role>"
        members     = ["<subject_type>:<subject_ID>","<subject_type>:<subject_ID>"]
      }
      ```

      Where:

      * `dns_zone_id`: DNS zone ID.
      * `role`: [Role](../security/index.md#roles-list) to assign.
      * `members`: Types and IDs of [entities](../../iam/concepts/access-control/index.md#subject) getting the role. Specify it as `userAccount:<user_ID>` or `serviceAccount:<service_account_ID>`.

       For more on the properties of the `yandex_dns_zone_iam_binding` resource, see [this provider guide](../../terraform/resources/dns_zone_iam_binding.md).

  1. Create the resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

      Terraform will create all the required resources. You can check the new resources using this [CLI](../../cli/index.md) command:

      ```bash
      yc dns zone list-access-bindings <zone_ID>
      ```

- API {#api}

  To assign a role, use the [updateAccessBindings](../api-ref/DnsZone/updateAccessBindings.md) REST API method for the [DnsZone](../api-ref/DnsZone/index.md) resource or the [DnsZoneService/UpdateAccessBindings](../api-ref/grpc/DnsZone/updateAccessBindings.md) gRPC API call. In the request body, set the `action` property to `ADD` and specify the user type and ID under `subject`.

{% endlist %}

## Assigning multiple roles {#set-access}

{% list tabs group=instructions %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  You can assign multiple roles using the `set-access-bindings` command.

  {% note alert %}

  The `set-access-binding` command completely overwrites access permissions for the resource! All roles previously assigned for this resource will be deleted.

  {% endnote %}

  1. Make sure the resource has no important roles assigned before proceeding:

      ```bash
      yc dns zone list-access-bindings <zone_ID>
      ```

  1. See the description of the CLI command for the DNS zone role assignment:

     ```bash
     yc dns zone set-access-bindings --help
     ```

  1. Assign roles:

     ```bash
     yc dns zone set-access-bindings <zone_ID> \
       --access-binding role=<role>,subject=<subject_type>:<subject_ID> \
       --access-binding role=<role>,subject=<subject_type>:<subject_ID>
     ```

     Where:

     * `--access-binding`: Access permission settings:
         * `role`: [Role](../security/index.md#roles-list) to assign.
         * `subject`: Type and ID of the [subject](../../iam/concepts/access-control/index.md#subject) the role is assigned to.

     For example, you can assign the `dns.editor` role to multiple users and a service account:

     ```bash
     yc dns zone set-access-bindings my-disk-group \
       --access-binding role=dns.editor,subject=userAccount:gfei8n54hmfh********
       --access-binding role=dns.editor,subject=serviceAccount:ajel6l0jcb9s********
     ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To assign multiple roles for a DNS zone using Terraform:

  1. In the Terraform configuration file, describe the resources you want to create:

      ```hcl
      resource "yandex_dns_zone_iam_binding" "role1" {
        dns_zone_id = "<zone_ID>"
        role        = "<role_1>"
        members     = ["<subject_type>:<subject_ID>"]
      }

      resource "yandex_dns_zone_iam_binding" "role2" {
        dns_zone_id = "<zone_ID>"
        role        = "<role_2>"
        members     = ["<subject_type>:<subject_ID>"]
      }
      ```

      Where:

      * `dns_zone_id`: DNS zone ID.
      * `role`: [Role](../security/index.md#roles-list) to assign.
      * `members`: Types and IDs of [entities](../../iam/concepts/access-control/index.md#subject) getting the role. Specify it as `userAccount:<user_ID>` or `serviceAccount:<service_account_ID>`.

      For more on the properties of the `yandex_dns_zone_iam_binding` resource, see [this provider guide](../../terraform/resources/dns_zone_iam_binding.md).

  1. Create the resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

      You can check the changes using this [CLI](../../cli/index.md) command:

      ```bash
      yc dns zone list-access-bindings <zone_ID>
      ```

- API {#api}

  To assign roles for a resource, use the [setAccessBindings](../api-ref/DnsZone/setAccessBindings.md) REST API method for the [DnsZone](../api-ref/DnsZone/index.md) resource or the [DnsZoneService/SetAccessBindings](../api-ref/grpc/DnsZone/setAccessBindings.md) gRPC API call.

  {% note alert %}

  The `setAccessBindings` method and the `DnsZoneService/SetAccessBindings` call overwrite all existing access permissions for the resource. All roles previously assigned for this resource will be deleted.

  {% endnote %}

{% endlist %}

## Revoking a role {#revoke-role}

{% list tabs group=instructions %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for revoking DNS zone roles:

      ```bash
      yc dns zone add-access-binding --help
      ```

  1. View the roles already assigned for the resource:

      ```bash
      yc dns zone list-access-bindings <zone_ID>
      ```

  1. To revoke access permissions, run this command:

     ```bash
     yc dns zone remove-access-binding <zone_ID> \
       --role=<role> \
       --subject=<subject_type>:<subject_ID> \
     ```

     Where:

     * `--role`: ID of the role you want to revoke.
     * `--subject`: Type and ID of the target [entity](../../iam/concepts/access-control/index.md#subject) for role revocation.

     For example, run the following command to revoke the `dns.editor` role from a user with the `ajel6l0jcb9s********` ID:

     ```bash
     yc dns zone remove-access-binding my-dns-zone \
       --role dns.editor \
       --subject userAccount:ajel6l0jcb9s********
     ```

- Terraform {#tf}

  With [Terraform](https://www.terraform.io/), you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
  
  Terraform is distributed under the [Business Source License](https://github.com/hashicorp/terraform/blob/main/LICENSE). The [Yandex Cloud provider for Terraform](https://github.com/yandex-cloud/terraform-provider-yandex) is distributed under the [MPL-2.0](https://www.mozilla.org/en-US/MPL/2.0/) license.
  
  For more information about the provider resources, see the guides on the [Terraform](https://www.terraform.io/docs/providers/yandex/index.html) website or [its mirror](../../terraform/index.md).

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To revoke a role assigned for a DNS zone:

  1. Open the Terraform configuration file and delete the fragment describing the role:

      ```hcl
      resource "yandex_dns_zone_iam_binding" "sa-role" {
        dns_zone_id = "<zone_ID>"
        role        = "<role>"
        members     = ["<subject_type>:<subject_ID>"]
      }
      ```

  1. Apply the changes:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.

      You can check the changes using this [CLI](../../cli/quickstart.md) command:

      ```bash
      yc dns zone list-access-bindings <zone_ID>
      ```

- API {#api}

  To revoke a role, use the [updateAccessBindings](../api-ref/DnsZone/updateAccessBindings.md) REST API method for the [DnsZone](../api-ref/DnsZone/index.md) resource or the [DnsZoneService/UpdateAccessBindings](../api-ref/grpc/DnsZone/updateAccessBindings.md) gRPC API call. In the request body, set the `action` property to `REMOVE` and specify the user type and ID under `subject`.

{% endlist %}