[Yandex Cloud documentation](../../../index.md) > [Yandex Identity and Access Management](../../index.md) > [Step-by-step guides](../index.md) > Service accounts > Creating a service account

# Creating a service account

{% note warning %}

Creating service accounts may be prohibited by [access policies](../../concepts/access-control/access-policies.md) at the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder), [cloud](../../../resource-manager/concepts/resources-hierarchy.md#cloud), or [organization](../../../organization/concepts/organization.md) level.

{% endnote %}

Create a [service account](../../concepts/users/service-accounts.md) to manage resources under a different account.

You must have the `iam.serviceAccounts.admin` [role](../../security/index.md#iam-serviceAccounts-admin) or higher for the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder) to create a service account.

{% note info %}

A service account is created inside a [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder). Once a service account has been created, you cannot change the folder.

You can assign roles to a service account for any resources in any cloud if these resources belong to the same organization as the service account. You can also assign roles to a service account for the organization.

{% endnote %}

## Create a service account {#create-sa}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../../_assets/console-icons/chevron-down.svg) in the top panel and select the [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder).
  1. Navigate to **Identity and Access Management**.
  1. Click **Create service account**.
  1. Enter a name for the service account.
  
     The naming requirements are as follows:
  
     * Length: between 3 and 63 characters.
     * It can only contain lowercase Latin letters, numbers, and hyphens.
     * It must start with a letter and cannot end with a hyphen.
  
     Make sure the service account name is unique within your cloud.
  
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. View the description of the command for creating a service account:

      ```bash
      yc iam service-account create --help
      ```

  1. Create a service account named `my-robot`:

      ```bash
      yc iam service-account create --name my-robot
      ```

      The naming requirements are as follows:

      * Length: between 3 and 63 characters.
      * It can only contain lowercase Latin letters, numbers, and hyphens.
      * It must start with a letter and cannot end with a hyphen.

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  1. In the configuration file, describe the resources you want to create:
    
     ```hcl
     resource "yandex_iam_service_account" "sa" {
       name        = "<service_account_name>"
       description = "<service_account_description>"
       folder_id   = "<folder_ID>"
     }
     ```

     * `name`: Service account name. This is a required parameter.
     * `description`: Service account description. This is an optional setting.
     * `folder_id`: [Folder ID](../../../resource-manager/operations/folder/get-id.md). This is an optional setting. It defaults to the value specified in the provider settings.

     For more information about `yandex_iam_service_account` properties, see [this Terraform provider guide](../../../terraform/resources/iam_service_account.md).
    
  1. Make sure the configuration files are correct.

     1. In the command line, navigate to the directory where you created the configuration file.
     1. Run a check using this command:

        ```bash
        terraform plan
        ```

     If the configuration description is correct, the terminal will display information about the service account. If the configuration contains any errors, Terraform will show them. 

  1. Deploy the cloud resources.

     1. If the configuration does not contain any errors, run this command:

        ```bash
        terraform apply
        ```

     1. Confirm creating the service account by typing `yes` in the terminal and pressing **Enter**.

        This will create the service account. You can check it using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/quickstart.md) command:
        
        ```bash
        yc iam service-account list
        ```

- API {#api}

  To create a service account, use the [create](../../api-ref/ServiceAccount/create.md) REST API method for the [ServiceAccount](../../api-ref/ServiceAccount/index.md) resource or the [ServiceAccountService/Create](../../api-ref/grpc/ServiceAccount/create.md) gRPC API call.

{% endlist %}


## Examples {#examples}

### Add a description when creating a service account {#add-description}

Create a service account with the following name and description:

{% list tabs group=instructions %}

- CLI {#cli}

  ```bash
  yc iam service-account create --name my-robot \
    --description "this is my favorite service account"
  ```

- Terraform {#tf}

  ```hcl
   resource "yandex_iam_service_account" "sa" {
     name        = "my-robot"
     description = "this is my favorite service account"
   }
  ```

- API {#api}

  ```bash
  curl \
    --request POST \
    --header 'Content-Type: application/json' \
    --header "Authorization: Bearer <IAM_token>" \
    --data '{
      "folderId": "b1gvmob95yys********",
      "name": "my-robot",
      "description": "this is my favorite service account"
    }' \
    https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts
  ```

{% endlist %}

#### See also {#see-also}

* [Getting a list of the folder's service accounts](list-get.md)
* [Assigning roles to a service account](assign-role-for-sa.md)
* [Setting up service account access permissions](set-access-bindings.md)
* [Service account keys](../../concepts/users/service-accounts.md#sa-key)