[Yandex Cloud documentation](../../index.md) > [Yandex Cloud Notification Service](../index.md) > Access management # Access management in Yandex Cloud Notification Service Yandex Cloud users can only perform operations on resources within the permissions of the [roles](../../iam/concepts/access-control/roles.md) assigned to them. With no roles assigned, almost no operations are allowed. To grant access to Yandex Cloud Notification Service resources, assign the relevant roles from the list below to a Yandex account, [service account](../../iam/concepts/users/service-accounts.md), [federated](../../iam/concepts/users/accounts.md#saml-federation) or [local](../../iam/concepts/users/accounts.md#local) users, [user group](../../organization/operations/manage-groups.md), [system group](../../iam/concepts/access-control/system-group.md), or [public group](../../iam/concepts/access-control/public-group.md). Currently, a role can only be assigned for a parent resource, i.e., folder or cloud, whose roles are inherited by nested resources. For more information about role inheritance, see [Inheritance of access permissions](../../resource-manager/concepts/resources-hierarchy.md#access-rights-inheritance) in the Resource Manager documentation. ## Roles available in the service {#roles-list} In Cloud Notification Service, you can manage access using both service and primitive roles. ```mermaid flowchart BT notifications.editor --> notifications.admin notifications.viewer --> notifications.editor notifications.publisher --> notifications.editor notifications.auditor --> notifications.viewer ``` ### Service roles {#service-roles} #### notifications.auditor {#notifications-auditor} The `notifications.auditor` role enables viewing metadata for all [notification channels](../concepts/index.md#channels), [topic](../concepts/topics.md) metadata, and info on Cloud Notification Service [quotas](../concepts/limits.md). #### notifications.viewer {#notifications-viewer} The `notifications.viewer` role enables viewing info on topics, notification channels, and Cloud Notification Service quotas. Users with this role can: * View info on [topics](../concepts/topics.md) and subscriptions in them. * View info on [mobile push notification](../concepts/push.md#mobile-channel) channels and their [endpoints](../concepts/push.md#mobile-endpoints). * View info on [browser push notification](../concepts/browser.md) channels and their [endpoints](../concepts/browser.md#create-endpoint). * View info on [text message (SMS)](../concepts/sms.md) channels, SMS [templates](../concepts/sms.md#templates), and [test](../concepts/sms.md#sandbox) phone numbers. * View info on Cloud Notification Service [quotas](../concepts/limits.md). This role includes the `notifications.auditor` permissions. #### notifications.publisher {#notifications-publisher} The `notifications.publisher` role enables sending notifications to all [channels](../concepts/index.md#channels) and [topics](../concepts/topics.md). #### notifications.editor {#notifications-editor} The `notifications.editor` role enables managing all notification channels and topics, as well as sending notifications to all channels and topics. Users with this role can: * View info on [topics](../concepts/topics.md) and create, modify, and delete them. * View info on subscriptions in topics, as well as create and delete them. * View info on [mobile push notification](../concepts/push.md#mobile-channel) channels and their [endpoints](../concepts/push.md#mobile-endpoints), as well as create, modify, and delete such channels and endpoints. * View info on [browser push notification](../concepts/push.md#mobile-channel) channels and their [endpoints](../concepts/push.md#mobile-endpoints), as well as create, modify, and delete such channels and endpoints. * View info on [text message (SMS) notification](../concepts/sms.md) channels, as well as create, modify, and delete them. * View info on text message (SMS) [templates](../concepts/sms.md#templates) and [test](../concepts/sms.md#sandbox) phone numbers, as well as modify them. * Send notifications to all topics and channels. * View info on Cloud Notification Service [quotas](../concepts/limits.md). This role includes the `notifications.viewer` and `notifications.publisher` permissions. #### notifications.admin {#notifications-admin} The `notifications.admin` role enables managing all notification channels and topics, as well as sending notifications to all channels and topics. Users with this role can: * View info on [topics](../concepts/topics.md) and create, modify, and delete them. * View info on subscriptions in topics, as well as create and delete them. * View info on [mobile push notification](../concepts/push.md#mobile-channel) channels and their [endpoints](../concepts/push.md#mobile-endpoints), as well as create, modify, and delete such channels and endpoints. * View info on [browser push notification](../concepts/push.md#mobile-channel) channels and their [endpoints](../concepts/push.md#mobile-endpoints), as well as create, modify, and delete such channels and endpoints. * View info on [text message (SMS) notification](../concepts/sms.md) channels, as well as create, modify, and delete them. * View info on text message (SMS) [templates](../concepts/sms.md#templates) and [test](../concepts/sms.md#sandbox) phone numbers, as well as modify them. * Send notifications to all topics and channels. * View info on Cloud Notification Service [quotas](../concepts/limits.md). This role includes the `notifications.editor` permissions. ### Primitive roles {#primitive-roles} Primitive roles allow users to perform actions in all Yandex Cloud [services](../../overview/concepts/services.md). #### auditor {#auditor} The `auditor` role grants a permission to read configuration and metadata of any Yandex Cloud resources without any access to data. For instance, users with this role can: * View info on a [resource](../../resource-manager/concepts/resources-hierarchy.md). * View the resource metadata. * View the list of operations with a resource. `auditor` is the most secure role that does not grant any access to the [service](../../overview/concepts/services.md) data. This role suits the users who need minimum access to the Yandex Cloud resources. #### viewer {#viewer} The `viewer` role grants the permissions to read the info on any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md). This role includes the `auditor` permissions. Unlike `auditor`, the `viewer` role provides access to [service](../../overview/concepts/services.md) data in read mode. #### editor {#editor} The `editor` role provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md), except for assigning roles to other users, transferring [organization](../../organization/concepts/organization.md) ownership, removing an organization, and deleting Key Management Service [encryption keys](../../kms/concepts/index.md). For instance, users with this role can create, modify, and delete resources. This role includes the `viewer` permissions. #### admin {#admin} The `admin` role enables assigning any roles, except for `resource-manager.clouds.owner` and `organization-manager.organizations.owner`, and provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md) (except for transferring [organization](../../organization/concepts/organization.md) ownership and removing an organization). Prior to assigning the `admin` role for an organization, [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [billing account](../../billing/concepts/billing-account.md), make sure to check out the information on protecting [privileged accounts](../../security/standard/all.md#privileged-users). This role includes the `editor` permissions. Instead of primitive roles, we recommend using service roles with more granular access control, allowing you to implement the [least privilege principle](../../security/standard/all.md#min-privileges). For more information on primitive roles, see the [Yandex Cloud role reference](../../iam/roles-reference.md#primitive-roles). ## Useful links {#see-also} [Hierarchy of Yandex Cloud resources](../../resource-manager/concepts/resources-hierarchy.md)