[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for Apache Airflow™](../index.md) > Access management

# Access management in Managed Service for Apache Airflow™


In this section, you will learn about the following:

* [Resources you can assign a role for](#resources).
* [Roles this service has](#roles-list).

## Access management {#about-access-control}

[Yandex Identity and Access Management](../../iam/index.md) checks all operations in Yandex Cloud. If an entity does not have required permissions, IAM returns an error.


To grant permissions for a resource, [assign](../../iam/operations/roles/grant.md) the relevant resource roles to an entity performing operations. You can assign roles to a [Yandex account](../../iam/concepts/users/accounts.md#passport), [service account](../../iam/concepts/users/service-accounts.md), [local user](../../iam/concepts/users/accounts.md#local), [federated user](../../iam/concepts/federations.md), [user group](../../organization/operations/manage-groups.md), [system group](../../iam/concepts/access-control/system-group.md), or [public group](../../iam/concepts/access-control/public-group.md). For more information, see [How access management works in Yandex Cloud](../../iam/concepts/access-control/index.md).

To assign a role for a resource, you need the `managed-airflow.admin` role or one of the following roles for that resource:

* `admin`
* `resource-manager.admin`
* `organization-manager.admin`
* `resource-manager.clouds.owner`
* `organization-manager.organizations.owner`

## Resources you can assign a role for {#resources}

You can assign a role to an [organization](../../organization/concepts/organization.md), [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). The roles assigned to organizations, clouds, and folders also apply to their nested resources.

To allow access to Managed Service for Apache Airflow™ resources, assign the user the appropriate roles for the folder, cloud, or organization containing these resources.

You can also assign a role for an individual cluster in the [management console](https://console.yandex.cloud), via the [CLI](../../cli/index.md), or [API](../api-ref/authentication.md).

## Roles existing in this service {#roles-list}

```mermaid
%%{
  init: {
    "flowchart": { "defaultRenderer": "elk" }
  }
}%%
flowchart BT
    managed-airflow.auditor --> managed-airflow.viewer 
    managed-airflow.viewer --> managed-airflow.user 
    managed-airflow.user --> managed-airflow.editor
    managed-airflow.editor --> managed-airflow.admin
    managed-airflow.auditor --> managed-airflow.maintenanceTask.viewer["`managed-airflow.
    maintenanceTask.viewer`"]
    managed-airflow.maintenanceTask.viewer --> managed-airflow.viewer
    managed-airflow.maintenanceTask.viewer --> managed-airflow.maintenanceTask.editor["`managed-airflow.
    maintenanceTask.editor`"]
    managed-airflow.maintenanceTask.editor --> managed-airflow.editor
    managed-airflow.integrationProvider["`managed-airflow.
    integrationProvider`"]
```

### Service roles {#service-roles}

The list below shows all the roles used for access control in Managed Service for Apache Airflow™.

#### managed-airflow.auditor {#managed-airflow-auditor}

The `managed-airflow.auditor` role enables viewing info on [Apache Airflow™ clusters](../concepts/index.md#cluster), [access permissions](../../iam/concepts/access-control/index.md) granted for them, and on [quotas](../concepts/limits.md#quotas) for Managed Service for Apache Airflow™.

#### managed-airflow.viewer {#managed-airflow-viewer}

The `managed-airflow.viewer` role enables viewing info on [Apache Airflow™ clusters](../concepts/index.md#cluster), [access permissions](../../iam/concepts/access-control/index.md) granted for them, and their [maintenance](../concepts/maintenance.md) tasks, as well as on [quotas](../concepts/limits.md#quotas) for Managed Service for Apache Airflow™.

This role includes the `managed-airflow.auditor` and `managed-airflow.maintenanceTask.viewer` permissions.

#### managed-airflow.user {#managed-airflow-user}

The `managed-airflow.user` role enables performing basic operations on Apache Airflow™ clusters.

Users with this role can:
* View info on [Apache Airflow™ clusters](../concepts/index.md#cluster) and [access permissions](../../iam/concepts/access-control/index.md) granted for them.
* Use the Apache Airflow™ [web interface](../operations/af-interfaces.md#web-gui).
* [Send requests](../operations/af-interfaces.md#rest-api) to the Apache Airflow™ API.
* View info on [maintenance](../concepts/maintenance.md) tasks for Apache Airflow™ clusters.
* View info on [quotas](../concepts/limits.md#quotas) for Managed Service for Apache Airflow™.

This role includes the `managed-airflow.viewer` permissions.

#### managed-airflow.editor {#managed-airflow-editor}

The `managed-airflow.editor` role enables managing Apache Airflow™ clusters.

Users with this role can:
* View info on [Apache Airflow™ clusters](../concepts/index.md#cluster), as well as create, modify, run, stop, and delete them.
* View info on [access permissions](../../iam/concepts/access-control/index.md) granted for Apache Airflow™ clusters.
* View info on [maintenance](../concepts/maintenance.md) tasks for Apache Airflow™ clusters and modify such tasks.
* Use the Apache Airflow™ [web interface](../operations/af-interfaces.md#web-gui).
* [Send requests](../operations/af-interfaces.md#rest-api) to the Apache Airflow™ API.
* View info on [quotas](../concepts/limits.md#quotas) for Managed Service for Apache Airflow™.

This role includes the `managed-airflow.user` and `managed-airflow.maintenanceTask.editor` permissions.

To create Apache Airflow™ clusters, you also need the `vpc.user` role.

#### managed-airflow.admin {#managed-airflow-admin}

The `managed-airflow.admin` role enables managing Apache Airflow™ clusters and access to them.

Users with this role can:
* View info on [access permissions](../../iam/concepts/access-control/index.md) granted for [Apache Airflow™ clusters](../concepts/index.md#cluster) and modify such permissions.
* View info on Apache Airflow™ clusters, as well as create, modify, run, stop, and delete them.
* View info on [maintenance](../concepts/maintenance.md) tasks for Apache Airflow™ clusters and modify such tasks.
* Use the Apache Airflow™ [web interface](../operations/af-interfaces.md#web-gui).
* [Send requests](../operations/af-interfaces.md#rest-api) to the Apache Airflow™ API.
* View info on [quotas](../concepts/limits.md#quotas) for Managed Service for Apache Airflow™.

This role includes the `managed-airflow.editor` permissions.

To create Apache Airflow™ clusters, you also need the `vpc.user` role.

#### managed-airflow.maintenanceTask.viewer {#managed-airflow-maintenanceTask-viewer}

The `managed-airflow.maintenanceTask.viewer` role enables viewing info on [Apache Airflow™ clusters](../concepts/index.md#cluster), [access permissions](../../iam/concepts/access-control/index.md) granted for them, and their [maintenance](../concepts/maintenance.md) tasks, as well as on [quotas](../concepts/limits.md#quotas) for Managed Service for Apache Airflow™.

This role includes the `managed-airflow.auditor` permissions.

#### managed-airflow.maintenanceTask.editor {#managed-airflow-maintenanceTask-editor}

The `managed-airflow.maintenanceTask.editor` role enables viewing info on [maintenance](../concepts/maintenance.md) tasks for Apache Airflow™ clusters and modifying such tasks, as well as viewing info on [Apache Airflow™ clusters](../concepts/index.md#cluster), [access permissions](../../iam/concepts/access-control/index.md) granted for them, and on [quotas](../concepts/limits.md#quotas) for Managed Service for Apache Airflow™.

This role includes the `managed-airflow.maintenanceTask.viewer` permissions.

#### managed-airflow.integrationProvider {#managed-airflow-integrationProvider}

The `managed-airflow.integrationProvider` role allows the Apache Airflow™ cluster to work with user resources required for its operation on behalf of the service account. You can assign this role to a service account linked to the Apache Airflow™ cluster.

{% cut "Service accounts with this role can:" %}

* Add entries to [log groups](../../logging/concepts/log-group.md).
* View info on log groups.
* View info on log sinks.
* View info on granted [access permissions](../../iam/concepts/access-control/index.md) for Cloud Logging resources.
* View info on log exports.
* View info on Monitoring [metrics](../../monitoring/concepts/data-model.md#metric) and their [labels](../../monitoring/concepts/data-model.md#label), as well as upload and download metrics.
* View the list of Monitoring [dashboards](../../monitoring/concepts/visualization/dashboard.md) and [widgets](../../monitoring/concepts/visualization/widget.md) and info on them, as well as create, modify, and delete them.
* View the Monitoring [notification](../../monitoring/concepts/alerting/notification-channel.md) history.
* View the list of [buckets](../../storage/concepts/bucket.md) and info on them, including their deployment region, [versioning](../../storage/concepts/versioning.md), [encryption](../../storage/concepts/encryption.md), [CORS](../../storage/concepts/cors.md) configuration, [static website hosting](../../storage/concepts/hosting.md) configuration, [HTTPS](../../storage/concepts/bucket.md#bucket-https) configuration, [logging](../../storage/concepts/server-logs.md) settings, granted access permissions, [public access](../../storage/concepts/bucket.md#bucket-access), and default [storage class](../../storage/concepts/storage-class.md#default-storage-class).
* View lists of [objects](../../storage/concepts/object.md) in buckets and info on these objects, including object [lifecycle](../../storage/concepts/lifecycles.md) configuration, granted access permissions for these objects, current [multipart uploads](../../storage/concepts/multipart.md), object versions with their [metadata](../../storage/concepts/object.md#metadata), and [object locks](../../storage/concepts/object-lock.md) (both with a retention period and legal hold).
* View bucket, object, and object version [labels](../../storage/concepts/tags.md), as well as Object Storage statistics.
* View info on [Yandex Lockbox secrets](../../lockbox/concepts/secret.md#secret) and granted access permissions for them.
* View details on [Object Storage](../../storage/concepts/limits.md#storage-quotas), [Monitoring](../../monitoring/concepts/limits.md#monitoring-quotas), and [Yandex Lockbox](../../lockbox/concepts/limits.md#quotas) quotas.
* View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud) and [folder](../../resource-manager/concepts/resources-hierarchy.md#folder).

{% endcut %}

This role includes the `logging.writer`, `monitoring.editor`, `storage.viewer`, and `lockbox.viewer` permissions.

The role does not provide access to Yandex Lockbox secret contents. To grant the Apache Airflow™ cluster access to Yandex Lockbox secret contents, additionally assign the `lockbox.payloadViewer` [role ](../../lockbox/security/index.md#lockbox-payloadViewer)to the [service account](../../iam/concepts/users/service-accounts.md) either for the relevant folder or for specific secrets.

### Primitive roles {#primitive-roles}

#### viewer {#viewer}

The `viewer` role enables you to view information about Managed Service for Apache Airflow™ clusters and their performance logs.

#### editor {#editor}

Users with the `editor` role can manage any resource, e.g., create clusters and create or delete their subclusters.

This role includes the `viewer` role.

#### admin {#admin}

Users with the `admin` role can manage resource access permissions, e.g., allow other users to create Managed Service for Apache Airflow™ clusters or to view information about user permissions.

This role includes the `editor` role.

## Required roles {#required-roles}

As a user, you need the [managed-airflow.editor role or higher](../../iam/concepts/access-control/roles.md) for the folder that will contain the new cluster. The `managed-airflow.viewer` role only allows you to view the list of clusters.

To create a Managed Service for Apache Airflow™ cluster, you need the [vpc.user](../../vpc/security/index.md#vpc-user) role and the `managed-airflow.editor` role or higher.

You can always assign a role with more permissions, e.g., `managed-airflow.admin` instead of `managed-airflow.editor`.

## What's next {#whats-next}

* [How to assign a role](../../iam/operations/roles/grant.md).
* [How to revoke a role](../../iam/operations/roles/revoke.md).
* [Learn more about access management in Yandex Cloud](../../iam/concepts/access-control/index.md).
* [Learn more about role inheritance](../../resource-manager/concepts/resources-hierarchy.md#access-rights-inheritance).