[Yandex Cloud documentation](../index.md) > [Yandex Identity and Access Management](index.md) > Getting started > How to work with service accounts

# Getting started with service accounts

In IAM, you can create [_service accounts_](concepts/users/service-accounts.md). These are auxiliary accounts that your programs can use to perform operations in Yandex Cloud. Service accounts are free of charge and enable flexible access management for your programs. For more information, see [Service accounts](concepts/users/service-accounts.md).

This guide is intended for [cloud owners](../resource-manager/concepts/resources-hierarchy.md#owner) and users with the [administrator](roles-reference.md#admin) role for a cloud or folder. Users with the [`editor`](roles-reference.md#editor) role can also create service accounts, but they cannot assign roles, so they cannot allow a service account to perform operations in Yandex Cloud.

{% note info %}

Creating service accounts and their [keys](concepts/users/service-accounts.md#sa-key) may be prohibited by [access policies](concepts/access-control/access-policies.md) at the [folder](../resource-manager/concepts/resources-hierarchy.md#folder), [cloud](../resource-manager/concepts/resources-hierarchy.md#cloud), or [organization](../organization/concepts/organization.md) level.

{% endnote %}

Checking for required roles is described in the [Getting started](#before-you-begin) section.

You will learn how to:

* [Create service accounts and assign roles to them](#create-sa).
* [Run operations in the CLI](#run-operation-from-sa).
* [Delete service accounts](#delete-sa).

## Getting started {#before-you-begin}

1. Log in to the [management console](https://console.yandex.cloud). If not signed up yet, navigate to the management console and follow the instructions.
1. Make sure that you have the required [roles](concepts/access-control/roles.md):

    1. In the management console, click ![image](../_assets/console-icons/layout-side-content-left.svg) or ![image](../_assets/console-icons/chevron-down.svg) in the top panel and select the cloud.
    1. Navigate to the **Access bindings** tab.
    1. Specify your account in the search bar.
    1. Check that your account has the following roles:

        * Organization owner (`organization-manager.organizations.owner`) or administrator (`organization-manager.admin`)
        * Cloud owner (`resource-manager.clouds.owner`) or administrator (`admin`)

1. On the [**Yandex Cloud Billing**](https://center.yandex.cloud/billing/accounts) page, make sure you have a linked [billing account](../billing/concepts/billing-account.md) and its status is `ACTIVE` or `TRIAL_ACTIVE`. If you do not have a billing account yet, [create one](../billing/quickstart/index.md#create_billing_account).

## Create a service account {#create-sa}

To create a service account and assign roles to it:

1. In the [management console](https://console.yandex.cloud), click ![image](../_assets/console-icons/layout-side-content-left.svg) or ![image](../_assets/console-icons/chevron-down.svg) in the top panel and select the [folder](../resource-manager/concepts/resources-hierarchy.md#folder).
1. In the left-hand panel, click ![image](../_assets/console-icons/dots-9.svg) and select **Identity and Access Management**.
1. Click **Create service account**.
1. Enter a name for the service account.

   The naming requirements are as follows:

   * Length: between 3 and 63 characters.
   * It can only contain lowercase Latin letters, numbers, and hyphens.
   * It must start with a letter and cannot end with a hyphen.

   Make sure the service account name is unique within your cloud.

1. To assign the service account a [role](concepts/access-control/roles.md) for the current folder, click **Add role** and select a role, e.g., `editor`.

   To assign a role for another resource, use the CLI or API following this [Assigning roles to a service account](operations/sa/assign-role-for-sa.md) guide.

1. Click **Create**.

{% note info %}

Other users can also use the service account you created. To allow them to do this, [assign](operations/sa/set-access-bindings.md#assign-role-to-sa) them the required [roles](security/index.md#service-roles) for this account.

{% endnote %}

## Configure the CLI to work under a service account {#run-operation-from-sa}

You can perform operations under a service account via the Yandex Cloud CLI, API, and other tools that support service account based authentication.

Configure the CLI to work on behalf of a service account:

1. If you do not have the Yandex Cloud CLI yet, [install and initialize it](../cli/quickstart.md#install).
1. The folder used by default is the one specified when [creating](../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
1. Get a list of available service accounts in the default folder:

    ```bash
    yc iam service-account list
    ```

    Result:

    ```bash
    +----------------------+----------+--------+
    |          ID          |   NAME   | LABELS |
    +----------------------+----------+--------+
    | ajeb9l33h6mu******** | my-robot |        |
    +----------------------+----------+--------+
    ```

1. Create an [authorized key](concepts/authorization/key.md) for your service account and save it to the file:

    ```bash
    yc iam key create --output <key_file_path> --service-account-name <service_account_name>
    ```

    Where:

    * `--output`: Path to the file for saving the authorized key in JSON format. This is a required setting.
    * `--service-account-name`: Service account name.

     Here is an example:

     ```bash
     yc iam key create --output key.json --service-account-name my-service-account
     ```

     Result:

     ```bash
     id: aje4lue48687********
     service_account_id: ajeb9l33h6m********
     created_at: "2024-08-01T11:58:52.313177213Z"
     key_algorithm: RSA_2048
     ```

    For more information about the `yc iam key create` command, see the [CLI reference](../cli/cli-ref/iam/cli-ref/service-account/create.md).

1. Create a profile to execute operations on behalf of the service account:

    ```bash
    yc config profile create <profile_name>
    ```

1. In the profile configuration, specify the service account’s authorized key:

    ```bash
    yc config set service-account-key <key_file_path>
    ```

Now you can perform operations on behalf of a service account, such as viewing the list of folders available to this account:

```bash
yc resource-manager folder list
```

## Delete the service account {#delete-sa}

Delete the service account if you no longer need it:

1. In the [management console](https://console.yandex.cloud), click ![image](../_assets/console-icons/layout-side-content-left.svg) or ![image](../_assets/console-icons/chevron-down.svg) in the top panel and select the [folder](../resource-manager/concepts/resources-hierarchy.md#folder).
1. In the left-hand panel, click ![image](../_assets/console-icons/dots-9.svg) and select **Identity and Access Management**.
1. In the left-hand panel, select ![FaceRobot](../_assets/console-icons/face-robot.svg) **Service accounts**.
1. In the row with the service account you need, click ![image](../_assets/console-icons/ellipsis.svg) and select **Delete**.
1. In the window that opens, click **Delete**.

## What's next {#what-is-next}

* The [step-by-step guides](operations/index.md) will help you perform specific tasks in Identity and Access Management.
* [Read more about service accounts](concepts/users/service-accounts.md) in the concepts section.
* See the [best practices for using service accounts securely](best-practices/using-iam-securely.md#use-sa).
* Use [authentication and authorization security checklist](../security/domains/iam-checklist.md).