[Yandex Cloud documentation](../../../index.md) > [Yandex Cloud Functions](../../index.md) > [Step-by-step guides](../index.md) > Managing function access permissions > Assigning roles for a function

# Assigning roles for a function

{% list tabs group=instructions %}

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    Run this command to assign a [role](../../security/index.md#roles-list) for a function:

    * To a user:
        ```
        yc serverless function add-access-binding \
          --id <function_ID> \
          --user-account-id <user_ID> \
          --role <role>
        ```
        Result:
        ```
        done (1s)
        ```
    * [To a service account](../../../iam/concepts/users/service-accounts.md):
        ```
        yc serverless function add-access-binding \
          --id <function_ID> \
          --service-account-id <service_account_ID> \
          --role <role>
        ```
        Result:
        ```
        done (1s)
        ```
    * To all authenticated users (the `All authenticated users` [public group](../../../iam/concepts/access-control/public-group.md)):
        ```
        yc serverless function add-access-binding \
          --id <function_ID> \
          --all-authenticated-users \
          --role <role>
        ```
        Result:
        ```
        done (1s)
        ```

- API {#api}

  To assign roles for a function, use the [setAccessBindings](../../functions/api-ref/Function/setAccessBindings.md) REST API method for the [Function](../../functions/api-ref/Function/index.md) resource or the [FunctionService/SetAccessBindings](../../functions/api-ref/grpc/Function/setAccessBindings.md) gRPC API call.

{% endlist %}