[Yandex Cloud documentation](../../index.md) > [Yandex Lockbox](../index.md) > Access management # Access management in Yandex Lockbox In this section, you will learn about: * [Resources you can assign a role for](#resources). * [Roles this service has](#roles-list). * [Roles required](#choosing-roles) for specific actions. ## Access management {#about-access-control} [Yandex Identity and Access Management](../../iam/index.md) checks all operations in Yandex Cloud. If an entity does not have required permissions, IAM returns an error. To grant permissions for a resource, [assign](../../iam/operations/roles/grant.md) the relevant resource roles to an entity performing operations. You can assign roles to a [Yandex account](../../iam/concepts/users/accounts.md#passport), [service account](../../iam/concepts/users/service-accounts.md), [local user](../../iam/concepts/users/accounts.md#local), [federated user](../../iam/concepts/federations.md), [user group](../../organization/operations/manage-groups.md), [system group](../../iam/concepts/access-control/system-group.md), or [public group](../../iam/concepts/access-control/public-group.md). For more information, see [How access management works in Yandex Cloud](../../iam/concepts/access-control/index.md). To assign a role for a resource, a user should have the `lockbox.admin` role or one of the following roles for that resource: * `admin` * `resource-manager.admin` * `organization-manager.admin` * `resource-manager.clouds.owner` * `organization-manager.organizations.owner` ## Resources you can assign a role for {#resources} You can assign a role to an [organization](../../organization/concepts/organization.md), [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). The roles assigned to organizations, clouds, and folders also apply to their nested resources. You can assign a role for a [secret](../concepts/secret.md) in the [management console](https://console.yandex.cloud) or using the Yandex Cloud [CLI](../../cli/cli-ref/lockbox/cli-ref/secret/add-access-binding.md), [API](../api-ref/authentication.md), or [Terraform](../../terraform/resources/lockbox_secret_iam_binding.md). ## Roles this service has {#roles-list} You can manage access to secrets using both service and primitive roles. The chart below shows service’s roles and their permission inheritance. For example, `editor` inherits all `viewer` permissions. You can find role descriptions below the chart. ```mermaid flowchart BT lockbox.editor --> lockbox.admin lockbox.payloadViewer ---> lockbox.admin lockbox.viewer --> lockbox.editor lockbox.auditor --> lockbox.viewer ``` ### Service roles {#service-roles} #### lockbox.auditor {#lockbox-auditor} The `lockbox.auditor` role enables viewing info on [secrets](../concepts/secret.md#secret) and on [access permissions](../../iam/concepts/access-control/index.md) assigned to them, as well as details on Yandex Lockbox [quotas](../concepts/limits.md#quotas) and [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) metadata. #### lockbox.viewer {#lockbox-viewer} The `lockbox.viewer` role enables viewing info on [secrets](../concepts/secret.md#secret) and [access permissions](../../iam/concepts/access-control/index.md) assigned to them, as well as info on the relevant [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) and Yandex Lockbox [quotas](../concepts/limits.md#quotas). This role includes the `lockbox.auditor` permissions. #### lockbox.editor {#lockbox-editor} The `lockbox.editor` role enables managing secrets and their versions, as well as viewing info on access permissions assigned to secrets. Users with this role can: * View info on [secrets](../concepts/secret.md#secret) and on [access permissions](../../iam/concepts/access-control/index.md) assigned to them, as well as create, activate, deactivate, and delete secrets. * Modify secret [version](../concepts/secret.md#version) metadata, create and delete secret versions, as well as change current secret versions, schedule deleting a secret version, or cancel a scheduled deletion. * View information on the relevant [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). * View details on Yandex Lockbox [quotas](../concepts/limits.md#quotas). This role includes the `lockbox.viewer` permissions. #### lockbox.admin {#lockbox-admin} The `lockbox.admin` role enables managing secrets, their versions, and access to them, as well as viewing secret contents. Users with this role can: * View info on [access permissions](../../iam/concepts/access-control/index.md) assigned to secrets and modify such permissions. * View info on [secrets](../concepts/secret.md#secret), including secret contents. * Create, activate, deactivate, and delete secrets. * Modify secret [version](../concepts/secret.md#version) metadata, create and delete secret versions, as well as change current secret versions, schedule deleting a secret version, or cancel a scheduled deletion. * View information on the relevant [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). * View details on Yandex Lockbox [quotas](../concepts/limits.md#quotas). This role includes the `lockbox.editor` and `lockbox.payloadViewer` permissions. #### lockbox.payloadViewer {#lockbox-payloadViewer} The `lockbox.payloadViewer` role enables viewing [secret](../concepts/secret.md#secret) contents. ### Primitive roles {#primitive-roles} Primitive roles allow users to perform actions in all Yandex Cloud [services](../../overview/concepts/services.md). #### auditor {#auditor} The `auditor` role grants a permission to read configuration and metadata of any Yandex Cloud resources without any access to data. For instance, users with this role can: * View info on a [resource](../../resource-manager/concepts/resources-hierarchy.md). * View the resource metadata. * View the list of operations with a resource. `auditor` is the most secure role that does not grant any access to the [service](../../overview/concepts/services.md) data. This role suits the users who need minimum access to the Yandex Cloud resources. #### viewer {#viewer} The `viewer` role grants the permissions to read the info on any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md). This role includes the `auditor` permissions. Unlike `auditor`, the `viewer` role provides access to [service](../../overview/concepts/services.md) data in read mode. #### editor {#editor} The `editor` role provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md), except for assigning roles to other users, transferring [organization](../../organization/concepts/organization.md) ownership, removing an organization, and deleting Key Management Service [encryption keys](../../kms/concepts/index.md). For instance, users with this role can create, modify, and delete resources. This role includes the `viewer` permissions. #### admin {#admin} The `admin` role enables assigning any roles, except for `resource-manager.clouds.owner` and `organization-manager.organizations.owner`, and provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md) (except for transferring [organization](../../organization/concepts/organization.md) ownership and removing an organization). Prior to assigning the `admin` role for an organization, [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [billing account](../../billing/concepts/billing-account.md), make sure to check out the information on protecting [privileged accounts](../../security/standard/all.md#privileged-users). This role includes the `editor` permissions. Instead of primitive roles, we recommend using service roles with more granular access control, allowing you to implement the [least privilege principle](../../security/standard/all.md#min-privileges). For more information on primitive roles, see the [Yandex Cloud role reference](../../iam/roles-reference.md#primitive-roles). ## What roles do I need {#choosing-roles} The table below lists the roles required for specific actions. You can always assign a role with more permissions. For example, you can assign the `editor` role instead of `viewer`. Action | `lockbox.admin` | `lockbox.editor` | `lockbox.viewer` | `lockbox.payloadViewer` | `kms.keys.encrypterDecrypter` ----- | ----- | ----- | ----- | ----- | ----- Create and delete secrets | ![image](../../_assets/common/yes.svg) | ![image](../../_assets/common/yes.svg) | - | - | - Change the metadata of the secret | ![image](../../_assets/common/yes.svg) | ![image](../../_assets/common/yes.svg) | - | - | - Read the metadata of the secret | ![image](../../_assets/common/yes.svg) | ![image](../../_assets/common/yes.svg) | ![image](../../_assets/common/yes.svg) | - | - Change the content of the secret version | ![image](../../_assets/common/yes.svg) | ![image](../../_assets/common/yes.svg) | - | - | - Read the content of the secret version | ![image](../../_assets/common/yes.svg) | - |- | ![image](../../_assets/common/yes.svg) | - Control access to the secret | ![image](../../_assets/common/yes.svg) | - | - | - | - Secret encryption and decryption operations | - | - | - | - | ![image](../../_assets/common/yes.svg) #### What's next {#what-is-next} * [Secure use of Yandex Cloud](../../iam/best-practices/using-iam-securely.md) * [How to assign a role](../../iam/operations/roles/grant.md). * [How to revoke a role](../../iam/operations/roles/revoke.md). * [Learn more about access management in Yandex Cloud](../../iam/concepts/access-control/index.md). * [Learn more about role inheritance](../../resource-manager/concepts/resources-hierarchy.md#access-rights-inheritance). * [Access management in Yandex Key Management Service](../../kms/security/index.md)