[Yandex Cloud documentation](../../index.md) > [Yandex Identity Hub](../index.md) > [Step-by-step guides](index.md) > Managing user groups > Granting permissions to a group

# Assigning a role for an entire organization

To enable group members to use Yandex Cloud resources within an organization, assign the appropriate [roles](../../iam/concepts/access-control/roles.md) to the group.

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.

  1. In the left-hand panel, select ![persons-lock](../../_assets/console-icons/persons-lock.svg) **Access bindings**.

  1. At the top right, click **Assign roles**.

  1. Go to the **Groups** tab and select the [group](../concepts/groups.md) you need or search by group name.

     You can also assign a role to one of the [system](../../iam/concepts/access-control/system-group.md) groups:

     * `All users in organization X`: The group includes all users in organization `X`.
     * `All users in federation N`: The group includes all users in federation `N`.

  1. Click ![plus](../../_assets/console-icons/plus.svg) **Add role** and select the [role](../../iam/concepts/access-control/roles.md) for the organization you want to assign to the group. You can assign multiple roles.

  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  1. Assign the [role](../../iam/concepts/access-control/roles.md) to the [group](../concepts/groups.md):

     ```bash
     yc organization-manager organization add-access-binding \
       --subject group:<group_ID> \
       --role <role_ID> \
       --organization-users <organization_ID> \
       --federation-users <federation_ID>
     ```

     To assign a role to one of the [system groups](../../iam/concepts/access-control/system-group.md), instead of the `--subject` parameter, use `--organization-users <organization_ID>` or `--federation-users <federation_ID>`. In the parameter, provide the [organization](../quickstart.md) or [identity federation](../concepts/add-federation.md) ID to all the users you want to assign the role to.
         
     You can also assign a role to a system group using the `--subject` parameter. To do this, provide in it the [subject](../../iam/concepts/access-control/index.md#subject) ID matching the selected system group.

  1. Make sure the requested permissions are granted:

     ```bash
     yc organization-manager organization list-access-bindings <organization_ID>
     ```

     A response contains a list of all roles assigned to users and groups in the organization:

     ```text
     +------------------------------------------+--------------+----------------------+
     |                 ROLE ID                  | SUBJECT TYPE |      SUBJECT ID      |
     +------------------------------------------+--------------+----------------------+
     | organization-manager.admin               | userAccount  | ajev1p2345lj******** |
     | organization-manager.organizations.owner | userAccount  | ajev1p2345lj******** |
     | editor                                   | group        | ajev1p2345lj******** |
     | viewer                                   | group        | ajev1p2345lj******** |
     +------------------------------------------+--------------+----------------------+
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Add the resource parameters to the configuration file and specify the required [role](../../iam/concepts/access-control/roles.md) and [group](../concepts/groups.md):

     ```hcl
     resource "yandex_organizationmanager_organization_iam_member" "users-editors" {
       organization_id = "<organization_ID>"
       role            = "<role_ID>"
       member          = "group:<group_ID>"
     }
     ```

     Where:
     
     * `organization_id`: [Organization ID](organization-get-id.md). This is a required setting.
     * `role`: Role being assigned. This is a required setting.
     * `member`: Group the role is assigned to. Use this format: `group:<group_ID>`. This is a required setting.

         To assign a role to one of the [system groups](../../iam/concepts/access-control/system-group.md), specify the following in the `member` parameter:

         * `system:group:organization:<organization_ID>:users`: To assign a role to the `All users in organization X` system group.
         * `system:group:federation:<federation_ID>:users`: To assign a role to the `All users in federation N` system group.

     For more on `yandex_organizationmanager_organization_iam_member` properties, see [this provider guide](../../terraform/resources/organizationmanager_organization_iam_member.md).
  1. Create the resources:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     This will create all the resources you need in the specified [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). You can check the new resources in the [Cloud Center UI](https://center.yandex.cloud/organization) or using this [CLI](../../cli/index.md) command:

     ```bash
     yc resource-manager folder list-access-bindings <folder_name_or_ID>
     ```

{% endlist %}