[Yandex Cloud documentation](../../../index.md) > [Yandex Identity and Access Management](../../index.md) > [Step-by-step guides](../index.md) > Authentication > Managing static access keys

# Managing static access keys

[Some Yandex Cloud services](../../concepts/authorization/access-key.md#supported-services) support authentication with [static access keys](../../concepts/authorization/access-key.md).

Static access keys are created for [service accounts](../../concepts/users/service-accounts.md). If you do not have a service account yet, [create one](../sa/create.md) and [assign roles to it](../sa/assign-role-for-sa.md).

## Creating a static access key {#create-access-key}

{% note info %}

Creating static access keys for service accounts may be prohibited by [access policies](../../concepts/access-control/access-policies.md) at the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder), [cloud](../../../resource-manager/concepts/resources-hierarchy.md#cloud), or [organization](../../../organization/concepts/organization.md) level.

{% endnote %}

To create a service account static access key:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../../_assets/console-icons/chevron-down.svg) in the top panel and select the folder the service account belongs to.
  1. In the list of services, select **Identity and Access Management**.
  1. In the left-hand panel, select ![FaceRobot](../../../_assets/console-icons/face-robot.svg) **Service accounts**.
  1. Select the service account to create a static access key for.
  1. In the top panel, click ![plus](../../../_assets/console-icons/plus.svg) **Create new key** and select **Create static access key**.
  1. Enter a description for the key and click **Create**.
  1. Save the ID and secret key.

      {% note alert %}

      After you close this dialog, the key value will no longer be available.

      {% endnote %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View the description of the command for creating a static access key:

      ```bash
      yc iam access-key create --help
      ```

  1. Select a service account, e.g., `my-robot`:

      ```bash
      yc iam service-account list
      ```

      Result:

      ```text
      +----------------------+------------------+-------------------------------+
      |          ID          |       NAME       |          DESCRIPTION          |
      +----------------------+------------------+-------------------------------+
      | aje6o61dvog2******** | my-robot         |                               |
      | aje9sda1ufvq******** | account_name     | account_description           |
      +----------------------+------------------+-------------------------------+
      ```
  1. Create an access key for the `my-robot` service account:

      ```bash
      yc iam access-key create --service-account-name my-robot
      ```

      Result:

      ```text
      access_key:
        id: aje6t3vsbj8l********
        service_account_id: ajepg0mjt06s********
        created_at: "2018-11-22T14:37:51Z"
        key_id: 0n8X6WY6S24N********
      secret: JyTRFdqw8t1kh2-OJNz4JX5ZTz9Dj1rI********
      ```

  1. Save the ID (`key_id`) and secret key (`secret`). You will not be able to get the key again.

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. In the configuration file, describe the resources you want to create:

      ```hcl
      resource "yandex_iam_service_account_static_access_key" "sa-static-key" {
        service_account_id = "<service_account_ID>"
        description        = "<key_description>"
        pgp_key            = "keybase:keybaseusername"
        output_to_lockbox  {
          secret_id             = "<Lockbox_secret_ID>"
          entry_for_access_key  = "<secret’s_key_for_static_key_ID>"
          entry_for_secret_key  = "<secret’s_key_for_secret_key>"
        }
      }
     ```

     Where:

     * `service_account_id`: Service account ID. This is a required setting.
     * `description`: Key description. This is an optional setting.
     * `pgp_key`: Additional PGP key for encrypting a private key. This is an optional setting. Specify the public part of the key in Base64 encoding or in `keybase:keybaseusername` format.

     * `output_to_lockbox`: Description of the Yandex Lockbox [secret](../../../lockbox/concepts/secret.md) to save the secret key values in to prevent their possible leakage through the `terraform.tfstate` file. This is an optional setting. Nested parameters:
         * `secret_id`: ID of the Yandex Lockbox secret to store the key ID and secret key in. The secret must be [custom](../../../lockbox/concepts/secret.md#secret-type).
         * `entry_for_access_key`: Secret key to assign to the static access key ID value you are saving.
         * `entry_for_secret_key`: Secret key to assign to the secret key value you are saving.

     For more on the properties of the `yandex_iam_service_account_static_access_key` resource in Terraform, see [this provider guide](../../../terraform/resources/iam_service_account_static_access_key.md).
         
  1. Make sure the configuration files are correct.

     1. In the terminal, navigate to the directory where you created your configuration file.
     1. Run a check using this command:

        ```bash
        terraform plan
        ```

     If the configuration is correct, the terminal will display a list of the resources and their settings. Otherwise, Terraform will show any detected errors.

  1. Deploy the cloud resources.

     1. If the configuration is correct, run this command:

        ```bash
        terraform apply
        ```

     1. Confirm creating the static access key by typing `yes` in the terminal and pressing **Enter**.

        If there are any errors when creating the key, Terraform will report them.
        If the key is created successfully, Terraform will store it in its state without showing it to the user. The terminal will display only the ID of the created key.

        You can verify that the service account key has been created using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/quickstart.md) command:
         
        ```bash
        yc iam access-key list --service-account-name=<service_account_name>
        ```

- API {#api}

  Use the [create](../../awscompatibility/api-ref/AccessKey/create.md) REST API method for the [AccessKey](../../awscompatibility/api-ref/AccessKey/index.md) resource or the [AccessKeyService/Create](../../awscompatibility/api-ref/grpc/AccessKey/create.md) gRPC API call.

{% endlist %}

### Examples {#examples}

#### Add a description when creating a service account {#add-description}

Add a description when creating an access key.

{% list tabs group=instructions %}

- CLI {#cli}

  ```bash
  yc iam access-key create \
    --service-account-name my-robot \
    --description "this key is for my bucket"
  ```

- Terraform {#tf}

  ```hcl
  resource "yandex_iam_service_account_static_access_key" "sa-static-key" {
    service_account_id = "<service_account_ID>"
    description        = "this key is for my bucket"
    pgp_key            = "BIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA+x....."
  }
  ```

- API {#api}

  ```bash
  curl \
    --request POST \
    --header 'Content-Type: application/json' \
    --header "Authorization: Bearer <IAM_token>" \
    --data '{
        "serviceAccountId": "<service_account_ID>",
        "description": "this key is for my bucket"
    }' \
    https://iam.api.cloud.yandex.net/iam/aws-compatibility/v1/accessKeys
  ```

{% endlist %}

## Deleting a static access key {#delete-access-key}

To delete a service account static access key:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../../_assets/console-icons/chevron-down.svg) in the top panel and select the folder the service account belongs to.
  1. In the list of services, select **Identity and Access Management**.
  1. In the left-hand panel, select ![FaceRobot](../../../_assets/console-icons/face-robot.svg) **Service accounts** and then select the required service account.
  1. Under **Static access keys**, click ![image](../../../_assets/console-icons/ellipsis.svg) in the row with the key to delete, and select **Delete**.
  1. In the window that opens, click **Delete**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Get a list of static access keys of the service account by specifying its name:

     ```bash
     yc iam access-key list \
       --service-account-name <service_account_name>
     ```

     Result:

     ```text
     +----------------------+----------------------+----------------------+
     |          ID          |  SERVICE ACCOUNT ID  |        KEY ID        |
     +----------------------+----------------------+----------------------+
     | aje8bdtqec6l******** | ajeedllrkjma******** | R9JK04o1Dfaf******** |
     | ajegqpa91bta******** | ajeedllrkjma******** | cWXGkDoBRho5******** |
     +----------------------+----------------------+----------------------+
     ```

  1. Delete the static access key by specifying its ID:

     ```bash
     yc iam access-key delete <key_ID>
     ```

- Terraform {#tf}

    If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
    
    
    To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

    1. Open the Terraform configuration file and delete the section with the static access key description.

        Example of a static access key description in the Terraform configuration:

        ```hcl
        resource "yandex_iam_service_account_static_access_key" "sa-static-key" {
          service_account_id = "<service_account_ID>"
          description        = "<key_description>"
          pgp_key            = "keybase:keybaseusername"
          output_to_lockbox  {
            secret_id             = "<Lockbox_secret_ID>"
            entry_for_access_key  = "<secret’s_key_for_static_key_ID>"
            entry_for_secret_key  = "<secret’s_key_for_secret_key>"
          }
        }
        ```

        For more information about the resources you can create with Terraform, see [this provider guide](../../../terraform/resources/iam_service_account_static_access_key.md).

    1. Make sure the configuration files are correct.

        1. In the terminal, navigate to the directory where you created your configuration file.
        1. Run a check using this command:

            ```bash
            terraform plan
            ```

        If the configuration is correct, the terminal will display a list of the resources and their settings. Otherwise, Terraform will show any detected errors.

    1. Deploy the cloud resources.

        1. If the configuration is correct, run this command:

            ```bash
            terraform apply
            ```

        1. Confirm creating and deleting the resources by typing `yes` in the terminal and clicking **Enter**.

        This will create or delete all the resources you need in the specified folder. You can check the new resources and their settings or make sure the resources were deleted using the [management console](https://console.yandex.cloud) and this CLI command:

        ```bash
        yc iam access-key list --service-account-id <service_account_ID>
        ```

- API {#api}

  Use the [delete](../../awscompatibility/api-ref/AccessKey/delete.md) REST API method for the [AccessKey](../../awscompatibility/api-ref/AccessKey/index.md) REST API resource or the [AccessKeyService/Delete](../../awscompatibility/api-ref/grpc/AccessKey/delete.md) gRPC API call.

{% endlist %}

#### Useful links {#see-also}

* [Static access keys compatible with the AWS API](../../concepts/authorization/access-key.md)
* [Configuring tools to work with Object Storage](../../../storage/tools/index.md)
* [Assigning roles to a service account](../sa/assign-role-for-sa.md)
* [Using a Yandex Lockbox secret to store a static access key](../../tutorials/static-key-in-lockbox/index.md)