[Yandex Cloud documentation](../../../index.md) > [Yandex Identity and Access Management](../../index.md) > [Step-by-step guides](../index.md) > Roles > Revoking a role

# Revoke a role for a resource

{% note info %}

Even if an [operation](../../../api-design-guide/concepts/about-async.md) with resources pertaining to Yandex Cloud [services](../../../overview/concepts/services.md) is allowed by a [role](../../concepts/access-control/roles.md), it may still be blocked if the [organization](../../../organization/concepts/organization.md), [cloud](../../../resource-manager/concepts/resources-hierarchy.md#cloud), or [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) is subject to an [access policy](../../concepts/access-control/access-policies.md) prohibiting this operation.

{% endnote %}

If you want to prevent a [subject](../../concepts/access-control/index.md#subject) from accessing a resource, revoke the relevant roles for this resource and for resources that grant inherited access rights. For more information, see [How access management works in Yandex Cloud](../../concepts/access-control/index.md).


## Revoking a role {#revoke-one-role}

{% list tabs group=instructions %}

- Management console {#console}

    * To revoke a role in the folder and its child resources:

        1. In the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../../_assets/console-icons/chevron-down.svg) in the top panel and select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder).
        1. Navigate to the **Access bindings** tab.
        1. Select a user from the list and click ![image](../../../_assets/console-icons/ellipsis.svg) next to the username.
        1. Click **Edit roles**.
        1. Click ![image](../../../_assets/console-icons/xmark.svg) next to the role to revoke.
        1. Click **Save**.

    * To revoke a role in the cloud:

        1. In the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../../_assets/console-icons/chevron-down.svg) in the top panel and select the cloud.
        1. Navigate to the **Access bindings** tab.
        1. Select a user from the list and click ![image](../../../_assets/console-icons/ellipsis.svg) next to the username.
        1. Click **Edit roles**.
        1. Click ![image](../../../_assets/console-icons/xmark.svg) next to the role to revoke.
        1. Click **Save**.

    * To revoke all the folder or cloud roles at once:

        1. In the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../../_assets/console-icons/chevron-down.svg) in the top panel and select a folder or cloud.
        1. Navigate to the **Access bindings** tab.
        1. Select a user from the list and click ![image](../../../_assets/console-icons/ellipsis.svg) next to the username.
        1. If you want to revoke all of the user's roles in the cloud, click **Revoke access** and confirm the revocation.

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

    To revoke a role from a subject, delete access permissions for the appropriate resource:

    1. View the roles assigned for a resource:
       
       ```bash
       yc <service_name> <resource_category> list-access-bindings <resource_name_or_ID>
       ```
       
       Where:
       
       * `<service_name>`: Name of the service the resource belongs to, e.g., `resource-manager`.
       * `<resource_category>`: Resource category, e.g., `folder`.
       * `<resource_name_or_ID>`: Resource name or ID. You can specify a resource by its name or ID.
       
       For example, you can view the roles and the assignees for the `default` folder:
       
       ```bash
       yc resource-manager folder list-access-bindings default
       ```
       
       Result:
       
       ```text
       +---------------------+----------------+----------------------+
       |       ROLE ID       |  SUBJECT TYPE  |      SUBJECT ID      |
       +---------------------+----------------+----------------------+
       | editor              | serviceAccount | ajepg0mjas06******** |
       | viewer              | userAccount    | aje6o61dvog2******** |
       +---------------------+----------------+----------------------+
       ```
    1. To delete access permissions, run this command:

        ```bash
        yc <service_name> <resource_category> remove-access-binding <resource_name_or_ID> \
            --role <role_ID> \
            --subject <subject_type>:<subject_ID>
        ```

        Where:
        * `--role`: ID of the role to revoke, e.g., `resource-manager.clouds.owner`.
        * `<subject_type>`: [Subject](../../concepts/access-control/index.md#subject) type to revoke a role from.
        * `<subject_ID>`: Subject ID.

- Terraform {#tf}

    If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
    
    
    To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

    1. To revoke a resource role from a subject, find the resource description in the configuration file:

        ```
        resource "yandex_resourcemanager_cloud_iam_binding" "admin" {
            cloud_id    = "<cloud_ID>"
            role        = "<role>"
            members     = [
            "serviceAccount:<service_account_ID>",
            "userAccount:<user_ID>",
            ]
        }
        ```

    1. Delete the record with information about the subject whose permissions you need to revoke from the `members` list of users.

       For more information about `yandex_resourcemanager_cloud_iam_binding` properties, see [this provider guide](../../../terraform/resources/iam_service_account_iam_binding.md).

    1. Make sure the configuration files are correct.

        1. In the command line, navigate to the directory where you created the configuration file.
        1. Run a check using this command:

          ```
          terraform plan
          ```

       If the configuration description is correct, the terminal will display a list of the resources being created and their settings. Terraform will show any errors in the configuration.

    1. Deploy the cloud resources.

        1. If the configuration does not contain any errors, run this command:

           ```
           terraform apply
           ```

        1. Confirm creating the resources: type `yes` and press **Enter**.

        This will create all the resources you need in the specified folder. You can check the new resource using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/quickstart.md) command:

        ```
        yc resource-manager cloud list-access-bindings <cloud_name_or_ID>
        ```

- API {#api}

    To revoke a resource role from a subject, delete the relevant access permissions:

    1. View the roles and assignees for the resource using the `listAccessBindings` REST API method. For example, to view the roles for the `b1gvmob95yys********` folder:
       
       ```bash
       export FOLDER_ID=b1gvmob95yys********
       export IAM_TOKEN=CggaATEVAgA...
       curl \
         --header "Authorization: Bearer ${IAM_TOKEN}" \
         "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:listAccessBindings"
       ```
       
       Result:
       
       ```json
       {
         "accessBindings": [
         {
           "subject": {
             "id": "ajei8n54hmfh********",
             "type": "userAccount"
           },
           "roleId": "editor"
         }
         ]
       }
       ```
    1. Create the request body, e.g., in the `body.json` file. In the request body, specify access permissions to delete. For example, revoke the `editor` role from the `ajei8n54hmfh********` user:

        **body.json:**
        ```json
        {
            "accessBindingDeltas": [{
                "action": "REMOVE",
                "accessBinding": {
                    "roleId": "editor",
                    "subject": {
                        "id": "ajei8n54hmfh********",
                        "type": "userAccount"
                        }
                    }
                }
            ]
        }
        ```

    1. Revoke a role by deleting the assigned permissions:

        ```bash
        export FOLDER_ID=b1gvmob95yys********
        export IAM_TOKEN=CggaAT********
        curl \
          --request POST \
          --header "Content-Type: application/json" \
          --header "Authorization: Bearer ${IAM_TOKEN}" \
          --data '@body.json' \
          "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:updateAccessBindings"
        ```

{% endlist %}