[Yandex Cloud documentation](../../../index.md) > [Yandex Identity and Access Management](../../index.md) > [Step-by-step guides](../index.md) > [Service accounts](index.md) > Suspending and reactivating a service account

# Suspending and reactivating a service account

To [suspend](#suspend) or [reactivate](#reactivate) a service account, you must have the `editor` role for the service account or at least the `iam.serviceAccounts.admin` [role](../../security/index.md#iam-serviceAccounts-admin) for the parent [folder](../../../resource-manager/concepts/resources-hierarchy.md#folder).

## Suspending a service account {#suspend}

Suspend a [service account](../../concepts/users/service-accounts.md) to pause its activity in Yandex Cloud. All its roles are retained, but become inactive until you restore the account.

{% list tabs group=instructions %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`.
  
  If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the command for suspending a service account:

      ```bash
      yc iam service-account suspend --help
      ```

  1. Get a list of service accounts in the default folder:

      ```bash
      yc iam service-account list
      ```

      Result:

      ```text
      +----------------------+------------------+-------------------------------+
      |          ID          |       NAME       |          DESCRIPTION          |
      +----------------------+------------------+-------------------------------+
      | aje6o61dvog2******** | my-robot         |                               |
      | aje9sda1ufvq******** | account_name     | account_description           |
      +----------------------+------------------+-------------------------------+
      ```

  1. Suspend the service account by specifying its name or ID:

      ```bash
      yc iam service-account suspend <account_name_or_ID>
      ```

      Here is an example:

      ```bash
      yc iam service-account suspend my-robot
      ```

- API {#api}

  To suspend a service account, use the [suspend](../../api-ref/ServiceAccount/suspend.md) REST API method for the [ServiceAccount](../../api-ref/ServiceAccount/index.md) resource or the [ServiceAccountService/Suspend](../../api-ref/grpc/ServiceAccount/suspend.md) gRPC API call.

{% endlist %}

## Reactivating a service account {#reactivate}

To restore [service account](../../concepts/users/service-accounts.md) activity in Yandex Cloud, reactivate it.

If the account was suspended due to expired lifetime (`--expires-at`), [set](update.md#update-expires-at) a new lifetime for the [service account](../../concepts/users/service-accounts.md#sa-suspend) or run the `reactivate` command as described below.

{% note warning %}

The `reactivate` command will reactivate the account, but it does not affect the `expires-at` setting. You account will be suspended again unless you [update](update.md#update-expires-at) its lifetime.

{% endnote %}

{% list tabs group=instructions %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`.
  
  If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the service account reactivation command:

      ```bash
      yc iam service-account reactivate --help
      ```

  1. Get a list of service accounts in the default folder:

      ```bash
      yc iam service-account list
      ```

      Result:

      ```text
      +----------------------+------------------+-------------------------------+
      |          ID          |       NAME       |          DESCRIPTION          |
      +----------------------+------------------+-------------------------------+
      | aje6o61dvog2******** | my-robot         |                               |
      | aje9sda1ufvq******** | account_name     | account_description           |
      +----------------------+------------------+-------------------------------+
      ```

  1. Reactivate the service account by specifying its name or ID:

      ```bash
      yc iam service-account reactivate <account_name_or_ID>
      ```

      Here is an example:

      ```bash
      yc iam service-account reactivate my-robot
      ```

- API {#api}

  To reactivate a service account, use the [reactivate](../../api-ref/ServiceAccount/reactivate.md) REST API method for the [ServiceAccount](../../api-ref/ServiceAccount/index.md) resource or the [ServiceAccountService/Reactivate](../../api-ref/grpc/ServiceAccount/reactivate.md) gRPC API call.

{% endlist %}

#### Useful links {#see-also}

* [Service accounts](../../concepts/users/service-accounts.md)
* [Creating a service account](create.md)
* [Updating a service account](update.md)
* [Deleting a service account](delete.md)