[Yandex Cloud documentation](../../../index.md) > [Yandex Identity and Access Management](../../index.md) > [Concepts](../index.md) > [How access management works](index.md) > Resources that roles can be assigned for

# Resources that roles can be assigned for


Yandex Cloud uses [roles](roles.md) to manage access permissions.

Yandex Cloud users can only perform operations on resources within the permissions of the [roles](roles.md) assigned to them. With no roles assigned, almost no operations are allowed.

## Inheriting access permissions {#permission-inheritance}

Roles are [assigned](../../operations/roles/grant.md) for Yandex Cloud [resources](../../../resource-manager/concepts/resources-hierarchy.md). The standard permission [inheritance](../../../resource-manager/concepts/resources-hierarchy.md#access-rights-inheritance) model applies to resources of most Yandex Cloud [services](../../../overview/concepts/services.md):

* Organization access permissions apply to the [organization's](../../../organization/concepts/organization.md) resources:
  * [Federations](../federations.md).
  * [User groups](../../../organization/concepts/groups.md).
  * Organization [clouds](../../../resource-manager/concepts/resources-hierarchy.md#cloud).
* Permissions to access the cloud apply to all [folders](../../../resource-manager/concepts/resources-hierarchy.md#folder) within the cloud.
* Folder access permissions apply to all resources in the folder.

### Exceptions to permission inheritance rules {#inheritance-exceptions}

Some Yandex Cloud services do not support the standard role inheritance model. Here are the services in which you need to specifically assign roles to users:

* [Yandex Cloud Billing](../../../billing/security/index.md)
* [Yandex Tracker](https://yandex.ru/support/tracker/ruaccess)
* [Yandex DataLens](../../../datalens/security/index.md)
* [Yandex Wiki](https://yandex.ru/support/wiki/ru/page-management/access-setup)
* [Yandex Forms](https://yandex.ru/support/forms/ru/access)
* [Yandex DataSphere](../../../datasphere/security/index.md)
* [Yandex SpeechSense](https://aistudio.yandex.ru/docs/en/speechsense/security/)

## Granular role assignment {#granular-assignment}

Some Yandex Cloud services allow you to assign roles in a more granular way, i.e., for individual resources within a service. For example, in [Yandex Compute Cloud](../../../compute/index.md), you can assign roles for the following resources:

# Compute Cloud resources for which you can assign roles

* [VM instance](../../../compute/operations/vm-control/vm-access.md)
* [Instance group](../../../compute/operations/instance-groups/access.md)
* [Dedicated host group](../../../compute/operations/dedicated-host/access.md)
* [VM placement group](../../../compute/operations/placement-groups/access.md)
* [Non-replicated disk placement group](../../../compute/operations/disk-placement-groups/access.md)
* [VM disk](../../../compute/operations/disk-control/disk-access.md)
* [GPU cluster](../../../compute/operations/gpu-cluster/access.md)
* [Image](../../../compute/operations/image-control/access.md)
* [Snapshot schedule](../../../compute/operations/snapshot-control/snapshot-schedule-access.md)
* [Disk snapshot](../../../compute/operations/snapshot-control/snapshot-access.md)
* [File storage](../../../compute/operations/filesystem/filesystem-access.md)

Note that some [interfaces](../../../overview/concepts/interfaces.md) do not support granular assignment of roles for resources. For example, you can assign a role for a Compute Cloud [instance group](../../../compute/concepts/instance-groups/index.md) using the [management console](https://console.yandex.cloud), [Yandex Cloud CLI](../../../cli/index.md) or [API](../../../api-design-guide/index.md), but not with [Terraform](../../../terraform/index.md).

For more information about resources you can assign roles for, available roles, and specifics of their assignment, see the **Access management** page for the relevant service, e.g., [Access management in Compute Cloud](../../../compute/security/index.md).