[Yandex Cloud documentation](../../../index.md) > [Yandex Identity and Access Management](../../index.md) > [Step-by-step guides](../index.md) > Roles > Assigning roles

# Assigning roles

To grant access to a resource, assign a [role](../../concepts/access-control/roles.md) for it. You can assign a role to:

* [Yandex account users](../../concepts/users/accounts.md#passport)
* [Local users](../../concepts/users/accounts.md#local)
* [Federated users](../../concepts/users/accounts.md#saml-federation)
* [Service accounts](../../concepts/users/service-accounts.md)
* [User groups](../../../organization/concepts/groups.md)

You can assign a role not only for the resource itself but also for its parent resource, as the former inherits access permissions from the latter. For example, if a service account gets a role for a cloud, it will also get permissions for all resources across the cloud's folders. For more information, see [How access management works in Yandex Cloud](../../concepts/access-control/index.md).

To assign a role for a resource, you need the `admin` or `service-name.admin` role, where `service-name` is the name of the service to which the resource belongs.

[Learn](../../concepts/access-control/resources-with-access-control.md) which resources you can assign a role for.

To select roles, look them up in the [role reference](../../roles-reference.md).

{% note info %}

Even if an [operation](../../../api-design-guide/concepts/about-async.md) with resources pertaining to Yandex Cloud [services](../../../overview/concepts/services.md) is allowed by a [role](../../concepts/access-control/roles.md), it may still be blocked if the [organization](../../../organization/concepts/organization.md), [cloud](../../../resource-manager/concepts/resources-hierarchy.md#cloud), or [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) is subject to an [access policy](../../concepts/access-control/access-policies.md) prohibiting this operation.

{% endnote %}

## Assigning a role for a cloud {#cloud-or-folder}

{% list tabs group=instructions %}

- Management console {#console}

   1. In the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../../_assets/console-icons/chevron-down.svg) in the top panel and select the cloud or folder.
   1. Navigate to the **Access bindings** tab.
   1. Click **Configure access**.
   1. Select the group, user, or service account you want to grant access to a cloud or folder.
   1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the required roles.
   1. Click **Save**.

- CLI {#cli}

   If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

   The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

   To assign a role for a cloud or folder:

   1. View the description of the CLI command for assigning roles:

      ```bash
      yc resource-manager <cloud_or_folder> add-access-binding --help
      ```

      Specify `cloud` for a cloud or `folder` for a folder.

   1. Get a list of available clouds or folders with their IDs:

      ```bash
      yc resource-manager <cloud_or_folder> list
      ```

   1. Get the [ID of the user](../../../organization/operations/users-get.md), [service account](../sa/get-id.md), user group, organization, or identity federation to which or the users of which you are assigning a role.
   1. Use one of these commands to assign a role:

      * To a Yandex account user or local user:

         ```bash
         yc resource-manager <cloud_or_folder> add-access-binding \
            --id <cloud_or_folder_ID> \
            --role <role> \
            --user-account-id <user_ID>
         ```

      * To a federated user:

         ```bash
         yc resource-manager <cloud_or_folder> add-access-binding \
            --id <cloud_or_folder_ID> \
            --role <role> \
            --subject federatedUser:<user_ID>
         ```

      * To a service account:

         ```bash
         yc resource-manager <cloud_or_folder> add-access-binding \
            --id <cloud_or_folder_ID> \
            --role <role> \
            --service-account-id <service_account_ID>
         ```

      * To a user group:

         ```bash
         yc resource-manager <cloud_or_folder> add-access-binding \
            --id <cloud_or_folder_ID> \
            --role <role> \
            --subject group:<group_ID>
         ```

      * To all users of an organization:

         ```bash
         yc resource-manager <cloud_or_folder> add-access-binding \
            --id <cloud_or_folder_ID> \
            --role <role> \
            --organization-users <organization_ID>
         ```

      * To all users of an identity federation:

         ```bash
         yc resource-manager <cloud_or_folder> add-access-binding \
            --id <cloud_or_folder_ID> \
            --role <role> \
            --federation-users <federation_ID>
         ```

- API {#api}

   To assign a role for a cloud, use the [updateAccessBindings](../../../resource-manager/api-ref/Cloud/updateAccessBindings.md) REST API method for the [Cloud](../../../resource-manager/api-ref/Cloud/index.md) resource or the [CloudService/UpdateAccessBindings](../../../resource-manager/api-ref/grpc/Cloud/updateAccessBindings.md) gRPC API call.

   To assign a role for a folder, use the [updateAccessBindings](../../../resource-manager/api-ref/Folder/updateAccessBindings.md) REST API method for the [Folder](../../../resource-manager/api-ref/Folder/index.md) resource or the [FolderService/UpdateAccessBindings](../../../resource-manager/api-ref/grpc/Folder/updateAccessBindings.md) gRPC API call.

   Provide the following in the request:

   * `ADD` value in the `accessBindingDeltas[].action` parameter to add a role.
   * Role in the `accessBindingDeltas[].accessBinding.roleId` parameter.
   * ID of the subject you are assigning the role to in the `accessBindingDeltas[].accessBinding.subject.id` parameter.
   * Type of the subject you are assigning the role to in the `accessBindingDeltas[].accessBinding.subject.type` parameter.

{% endlist %}

## Assigning a role for an organization {#organization}

To grant access permissions for an organization, you need the `organization-manager.admin` role or higher. For more information on role sequence, see [this Yandex Identity Hub document](../../../organization/security/index.md#roles-list).

To assign a role for an organization:

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.

  1. In the left-hand panel, select ![persons-lock](../../../_assets/console-icons/persons-lock.svg) **Access bindings**.

  1. If the user, service account, or user group already has at least one role assigned, click ![icon-context-menu](../../../_assets/console-icons/ellipsis.svg) in the row with that user, service account, or group and select **Assign roles**.

      If the user, service account, or user group is not on the list, click **Assign roles** in the top-right corner. In the window that opens, select the user, service account, or group from the list. If required, use the search bar.

  1. Click ![plus](../../../_assets/console-icons/plus.svg) **Add role** and select the [role](../../concepts/access-control/roles.md) to assign. You can assign multiple roles.

      You can find the description of the available roles in the [Yandex Cloud role reference](../../roles-reference.md).

  1. Click **Save**.

- CLI {#cli}

   If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

   The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

   To assign a role for an organization:

   1. View the description of the CLI command for assigning roles:

      ```bash
      yc organization-manager organization add-access-binding --help
      ```

   1. Get a list of available organizations with their IDs:

      ```bash
      yc organization-manager organization list
      ```

   1. Get the [ID of the user](../../../organization/operations/users-get.md), [service account](../sa/get-id.md), user group, organization, or identity federation to which or the users of which you are assigning a role.
   1. Use one of these commands to assign a role:

      * To a Yandex account user or local user:

         ```bash
         yc organization-manager organization add-access-binding \
            --id <organization_ID> \
            --role <role> \
            --user-account-id <user_ID>
         ```

      * To a federated user:

         ```bash
         yc organization-manager organization add-access-binding \
            --id <organization_ID> \
            --role <role> \
            --subject federatedUser:<user_ID>
         ```

      * To a service account:

         ```bash
         yc organization-manager organization add-access-binding \
            --id <organization_ID> \
            --role <role> \
            --service-account-id <service_account_ID>
         ```

      * To all users of an organization:

         ```bash
         yc organization-manager organization add-access-binding \
            --id <organization_ID> \
            --role <role> \
            --organization-users <organization_ID>
         ```

      * To all users of an identity federation:

         ```bash
         yc organization-manager organization add-access-binding \
            --id <organization_ID> \
            --role <role> \
            --federation-users <federation_ID>
         ```


- Terraform {#tf}

   If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
   
   
   To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

   To assign a role for an organization:

   1. Get the [ID of the user](../../../organization/operations/users-get.md), [service account](../sa/get-id.md), or user group you are assigning a role to.
   1. Describe the resource with the role for the organization in the configuration file.

      Here is an example of the configuration file structure:

      ```hcl
      resource "yandex_organizationmanager_organization_iam_binding" "<resource_name>" {
        organization_id = "<organization_ID>"
        role            = "<role>"
        members         = [<users>]
      }
      ```

      Where:

      * `organization_id`: [Organization ID](../../../organization/operations/organization-get-id.md). This is a required setting.
      * `role`: Role to assign. For each role, you can only use one `yandex_organizationmanager_organization_iam_binding` resource. This is a required setting.
      * `members`: Users getting the role. Specify the following:

         * `members = ["userAccount:<user_ID>"]`: For a Yandex account user or local user.
         * `members = ["federatedUser:<user_ID>"]`: For a federated user.
         * `members = ["serviceAccount:<user_ID>"]`: For a service account.
         * `members = ["group:<user_ID>"]`: For a user group.
         * `members = ["system:group:organization:<organization_ID>:users"]`: For all [organization](../../../organization/quickstart.md) users.
         * `members = ["system:group:federation:<organization_ID>:users"]`: For all [identity federation](../../../organization/concepts/add-federation.md) users.

      For more information, see [this provider guide](../../../terraform/index.md).

   1. Make sure the settings are correct.

      1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
      1. Run this command:
      
         ```bash
         terraform validate
         ```
      
         Terraform will show any errors found in your configuration files.

   1. Assign the role.

      1. Run this command to view the planned changes:
      
         ```bash
         terraform plan
         ```
      
         If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
      
      1. If everything looks correct, apply the changes:
         1. Run this command:
      
            ```bash
            terraform apply
            ```
      
         1. Confirm updating the resources.
         1. Wait for the operation to complete.

      This will create the necessary resources in the organization. You can check the new resources using the [management console](https://console.yandex.cloud) or this CLI command:

      ```bash
      yc organization-manager organization list-access-bindings <organization_name_or_ID>
      ```

- API {#api}

   To assign a role for the organization, use the [updateAccessBindings](../../../organization/api-ref/Organization/updateAccessBindings.md) REST API method for the [Organization](../../../organization/api-ref/Organization/index.md) resource or the [OrganizationService/UpdateAccessBindings](../../../organization/api-ref/grpc/Organization/updateAccessBindings.md) gRPC API call and provide the following in the request:

   * `ADD` value in the `accessBindingDeltas[].action` parameter to add a role.
   * Role in the `accessBindingDeltas[].accessBinding.roleId` parameter.
   * ID of the subject you are assigning the role to in the `accessBindingDeltas[].accessBinding.subject.id` parameter.
   * Type of the subject you are assigning the role to in the `accessBindingDeltas[].accessBinding.subject.type` parameter.

{% endlist %}

## Assigning a role for a resource {#resource}

You can assign a role not only for an organization, cloud, or folder but their child resources as well. These are listed in [Resources that roles can be assigned for](../../concepts/access-control/resources-with-access-control.md).

{% list tabs group=instructions %}

- Management console {#console}

   To assign a role for a resource:

   1. In the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../../_assets/console-icons/chevron-down.svg) in the top panel and select the folder containing the resource.
   1. Open its page.
   1. Navigate to ![image](../../../_assets/console-icons/persons.svg) **Access bindings** and click **Assign roles**.
   1. Select the group, user, or service account you want to grant access to a resource.
   1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the required roles.
   1. Click **Save**.

- CLI {#cli}

   If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

   The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

   To assign a role for a resource:

   1. View the description of the CLI command for assigning roles:

      ```bash
      yc <service_name> <resource> add-access-binding --help
      ```

      Example for a [Yandex Compute Cloud VM](../../../compute/concepts/vm.md):

      ```bash
      yc compute instance add-access-binding --help
      ```

   1. Get a list of resources with their IDs:

      ```bash
      yc <service_name> <resource> list
      ```

   1. Get the [ID of the user](../../../organization/operations/users-get.md), [service account](../sa/get-id.md), user group, organization, or identity federation to which or the users of which you are assigning a role.
   1. Use one of these commands to assign a role:

      * To a Yandex account user or local user:

         ```bash
         yc <service_name> <resource> add-access-binding \
            --id <resource_ID> \
            --role <role> \
            --user-account-id <user_ID>
         ```

      * To a federated user:

         ```bash
         yc <service_name> <resource> add-access-binding \
            --id <resource_ID> \
            --role <role> \
            --subject federatedUser:<user_ID>
         ```

      * To a service account:

         ```bash
         yc <service_name> <resource> add-access-binding \
            --id <resource_ID> \
            --role <role> \
            --service-account-id <service_account_ID>
         ```

      * To a user group:

         ```bash
         yc <service_name> <resource> add-access-binding \
            --id <resource_ID> \
            --role <role> \
            --subject group:<group_ID>
         ```

      * To all users of an organization:

         ```bash
         yc <service_name> <resource> add-access-binding \
            --id <resource_ID> \
            --role <role> \
            --organization-users <organization_ID>
         ```

      * To all users of an identity federation:

         ```bash
         yc <service_name> <resource> add-access-binding \
            --id <resource_ID> \
            --role <role> \
            --federation-users <federation_ID>
         ```

- API {#api}

   To assign a role for a resource, use the `updateAccessBindings` REST API method or gRPC API call for the resource and provide the following in the request:

   * `ADD` value in the `accessBindingDeltas[].action` parameter to add a role.
   * Role in the `accessBindingDeltas[].accessBinding.roleId` parameter.
   * ID of the subject you are assigning the role to in the `accessBindingDeltas[].accessBinding.subject.id` parameter.
   * Type of the subject you are assigning the role to in the `accessBindingDeltas[].accessBinding.subject.type` parameter.

{% endlist %}

## Assigning multiple roles {#multiple-roles}

{% list tabs group=instructions %}

- Management console {#console}

   1. In the [management console](https://console.yandex.cloud), select the folder the resource resides in.
   1. Open its page.
   1. Navigate to ![image](../../../_assets/console-icons/persons.svg) **Access bindings** and click **Assign roles**.
   1. Select the group, user, or service account you want to grant access to a resource.
   1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the required roles.
   1. Click **Save**.

- CLI {#cli}

   {% note alert %}
   
   The `set-access-bindings` command for assigning multiple roles completely rewrites access permissions for the resource. All current resource roles will be deleted.
   
   {% endnote %}

   If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

   The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

   To assign multiple roles for a resource:

   1. Make sure the resource has no important roles assigned before proceeding:

      ```bash
      yc <service_name> <resource> list-access-bindings \
         --id <resource_ID>
      ```

      Example for a [Yandex Compute Cloud VM](../../../compute/concepts/vm.md):

      ```bash
      yc compute instance list-access-bindings \
         --id <VM_ID>
      ```

   1. View the description of the CLI command for assigning roles:

      ```bash
      yc <service_name> <resource> set-access-bindings --help
      ```

   1. Get a list of resources with their IDs:

      ```bash
      yc <service_name> <resource> list
      ```

   1. Get the [ID of the user](../../../organization/operations/users-get.md), [service account](../sa/get-id.md), user group, organization, or identity federation to which or the users of which you are assigning a role.
   1. Use one of the commands below to assign roles:

      * To a Yandex account user or local user:

         ```bash
         yc <service_name> <resource> set-access-bindings \
            --id <resource_ID> \
            --access-binding role=<role>,user-account-id=<user_ID>
         ```

      * To a federated user:

         ```bash
         yc <service_name> <resource> set-access-bindings \
            --id <resource_ID> \
            --access-binding role=<role>,subject=federatedUser:<user_ID>
         ```

      * To a service account:

         ```bash
         yc <service_name> <resource> set-access-bindings \
            --id <resource_ID> \
            --access-binding role=<role>,service-account-id=<service_account_ID>
         ```

      * To a user group:

         ```bash
         yc <service_name> <resource> set-access-bindings \
            --id <resource_ID> \
            --access-binding role=<role>,subject=group:<group_ID>
         ```

      * To all users of an organization:

         ```bash
         yc <service_name> <resource> set-access-bindings \
            --id <resource_ID> \
            --access-binding role=<role>,subject=system:group:organization:<organization_ID>:users
         ```

      * To all users of an identity federation:

         ```bash
         yc <service_name> <resource> set-access-bindings \
            --id <resource_ID> \
            --access-binding role=<role>,subject=system:group:federation:<federation_ID>:users
         ```

      Provide a separate `--access-binding` parameter for each role. Here is an example:

      ```bash
      yc <service_name> <resource> set-access-bindings \
         --id <resource_ID> \
         --access-binding role=<role_1>,service-account-id=<service_account_ID> \
         --access-binding role=<role_2>,service-account-id=<service_account_ID> \
         --access-binding role=<role_3>,service-account-id=<service_account_ID>
      ```

- API {#api}

   {% note alert %}
   
   The `setAccessBindings` method for assigning multiple roles completely rewrites access permissions for the resource. All current resource roles will be deleted.
   
   {% endnote %}

   To assign multiple roles for a resource, use the `setAccessBindings` REST API method or gRPC API call for the resource. In your request, provide an array of objects, each one matching a particular role and containing the following data:

   * Role in the `accessBindings[].roleId` parameter.
   * ID of the subject getting the roles in the `accessBindings[].subject.id` parameter.
   * Type of the subject getting the roles in the `accessBindings[].subject.type` parameter.

{% endlist %}