[Yandex Cloud documentation](../../index.md) > [Yandex Identity Hub](../index.md) > [Step-by-step guides](index.md) > Managing user groups > Configuring group management access

# Configuring group management access

You can grant access to a user group to:

* [Yandex account users](../../iam/concepts/users/accounts.md#passport)
* [Federated users](../../iam/concepts/users/accounts.md#saml-federation)
* [Local users](../../iam/concepts/users/accounts.md#local)
* [Service accounts](../../iam/concepts/users/service-accounts.md)
* Other [user groups](../concepts/groups.md)

To do this, assign [roles](../../iam/concepts/access-control/roles.md) for the group. To choose the ones you need, [learn](../security/index.md#roles-list) about the service's roles.

## Assigning a role {#add-access-binding}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.

  1. In the left-hand panel, select ![groups](../../_assets/console-icons/persons.svg) **Groups** and click the row with the name of the [group](../concepts/groups.md) you need.
  
  1. Navigate to the **Group access rights** tab.

  1. Click **Assign roles**.
  
  1. Select the group, user, or [service account](../../iam/concepts/users/service-accounts.md) you want to grant access to the group. Use search, if required.
  
  1. Click ![image](../../_assets/console-icons/plus.svg) **Add role** and select the roles that you need to assign to the group.

  1. Click **Save**.

- CLI {#cli}

    If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

    The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

    To grant access permissions for a user group:

    1. View the description of the CLI command for assigning roles:

        ```bash
        yc organization-manager group add-access-binding --help
        ```

    1. Get a list of user groups with their IDs:

        ```bash
        yc organization-manager group list \
          --organization-id <organization_ID>
        ```

    1. Get the [ID of the user](users-get.md), [service account](../../iam/operations/sa/get-id.md), or user group you are assigning a role to.
    1. Using the `yc organization-manager group add-access-binding` command, assign the following roles:

        ```bash
        yc organization-manager group add-access-binding \
          --id <group_ID> \
          --role <role> \
          --user-account-id <user_ID> \
          --federation-users <user_ID> \
          --service-account-id <service_account_ID> \
          --subject group: <group_ID>
        ```

        Where:

        * `--id`: User group ID.
        * `--role`: Role ID.

        ID of the object the role is assigned to.

        * `--user-account-id`: Yandex account ID.
        * `--federation-users`: Federated user ID.
        * `--service-account-id`: Service account ID.
        * `--subject group`: Group ID.

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Describe the parameters of the roles you assign in the configuration file:

      ```hcl
      resource "yandex_organizationmanager_group_iam_binding" "editor" {
        group_id = "<group_ID>"
        role     = "<role_ID>"
        members  = [
          "userAccount:<user_ID>",
        ]
      }
      ```

      Where:

      * `group_id`: [User group ID](group-get-id.md).
      * `role`: Role you want to assign. For each role, you can only use one `yandex_organizationmanager_group_iam_binding` resource.
      * `members`: Array of the IDs of users to assign the role to:

        * `userAccount:<user_ID>`: ID of the user Yandex account or local user ID.
        * `federatedUser:<user_ID>`: Federated user ID.
        * `serviceAccount:<service_account_ID>`: Service account ID.
        * `group:<group_ID>`: User group ID.

      For more information about the resources you can create with Terraform, see [this provider guide](../../terraform/index.md).

  1. Create the required resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.
   
  After this, the specified users will be assigned roles for the user group. You can check the role in the [Cloud Center](https://center.yandex.cloud/organization) interface.

- API {#api}

   Use the [updateAccessBindings](../api-ref/Group/updateAccessBindings.md) method for the [Group](../api-ref/Group/index.md) resource or the [GroupService/UpdateAccessBindings](../api-ref/grpc/Group/updateAccessBindings.md) gRPC API call and provide the following in the request:

   * `ADD` value in the `accessBindingDeltas[].action` parameter to add a role.
   * Role in the `accessBindingDeltas[].accessBinding.roleId` parameter.
   * ID of the subject you are assigning the role to in the `accessBindingDeltas[].accessBinding.subject.id` parameter.
   * Type of the subject you are assigning the role to in the `accessBindingDeltas[].accessBinding.subject.type` parameter.

{% endlist %}

## Assigning multiple roles {#set-access-bindings}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) as the organization administrator or owner.

  1. In the left-hand panel, select ![groups](../../_assets/console-icons/persons.svg) **Groups** and click the line with the [group](../concepts/groups.md) name.
  
  1. Navigate to the **Group access rights** tab.

  1. Click **Assign roles**.
  
  1. Select the user or [service account](../../iam/concepts/users/service-accounts.md) you want to grant access to the group. Use search, if required.
  
  1. Click ![image](../../_assets/console-icons/plus.svg) **Add role** and select the roles that you need to assign to the group.

  1. Click **Save**.

- CLI {#cli}

   {% note alert %}
   
   The `set-access-bindings` command for assigning multiple roles completely rewrites access permissions for the resource. All current resource roles will be deleted.
   
   {% endnote %}

   If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

   The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

   To assign multiple roles for a user group:

   1. Make sure the resource has no important roles assigned before proceeding:

      ```bash
      yc organization-manager group list-access-bindings \
        --id <group_ID>
      ```

   1. View the description of the CLI command for assigning roles:

      ```bash
      yc organization-manager group set-access-bindings --help
      ```
 
   1. Get a list of user groups with their IDs:

      ```bash
      yc organization-manager group list
      ```
   1. Get the [ID of the user](users-get.md), [service account](../../iam/operations/sa/get-id.md), or [user group](group-get-id.md) you are assigning roles to.

   1. Using the `yc organization-manager group set-access-bindings` command, assign the following roles:

      * To a Yandex account user or local user:

         ```bash
         yc organization-manager group set-access-bindings \
           --id <group_ID> \
           --access-binding role=<role>,user-account-id=<user_ID>
         ```

      * To a federated user:

         ```bash
         yc organization-manager group set-access-bindings \
           --id <group_ID> \
           --access-binding role=<role>,subject=federatedUser:<user_ID>
         ```

      * To a service account:

         ```bash
         yc organization-manager group set-access-bindings \
           --id <group_ID> \
           --access-binding role=<role>,service-account-id=<service_account_ID>
         ```

      * To a user group:

         ```bash
         yc organization-manager group set-access-bindings \
           --id <group_ID> \
           --access-binding role=<role>,subject=group:<group_ID>
         ```

      Provide a separate `--access-binding` parameter for each role. Example:

      ```bash
      yc organization-manager group set-access-bindings \
        --id <group_ID> \
        --access-binding role=<role_1>,service-account-id=<service_account_ID> \
        --access-binding role=<role_2>,service-account-id=<service_account_ID> \
        --access-binding role=<role_3>,service-account-id=<service_account_ID>
      ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To assign multiple roles for a user group:

  1. Describe the parameters of the roles you assign in the configuration file:

      ```hcl
      resource "yandex_organizationmanager_group_iam_binding" "role1" {
        group_id = "<group_ID>"
        role     = "<role1>"
        members  = ["<subject_type>:<subject_ID>"]
      }

      resource "yandex_organizationmanager_group_iam_binding" "role2" {
        group_id = "<group_ID>"
        role     = "<role2>"
        members  = ["<subject_type>:<subject_ID>"]
      }

      resource "yandex_organizationmanager_group_iam_binding" "role3" {
        group_id = "<group_ID>"
        role     = "<role3>"
        members  = ["<subject_type>:<subject_ID>"]
      }
      ```

      Where:

      * `group_id`: [User group ID](group-get-id.md).
      * `role`: Role you want to assign. For each role, you can only use one `yandex_organizationmanager_group_iam_binding` resource.
      * `members`: Array of the IDs of users to assign the role to:

        * `userAccount:<user_ID>`: ID of the user Yandex account or local user ID.
        * `federatedUser:<user_ID>`: Federated user ID.
        * `serviceAccount:<service_account_ID>`: Service account ID.
        * `group:<group_ID>`: User group ID.

      For more information about the resources you can create with Terraform, see [this provider guide](../../terraform/index.md).

  1. Create the required resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.
   
  After that, the specified user will be assigned multiple roles for the user group. You can check the new roles using the [Cloud Center UI](https://center.yandex.cloud/organization).

- API {#api}

   {% note alert %}
   
   The `setAccessBindings` method for assigning multiple roles completely rewrites access permissions for the resource. All current resource roles will be deleted.
   
   {% endnote %}

   Use the [setAccessBindings](../api-ref/Group/setAccessBindings.md) method for the [Group](../api-ref/Group/index.md) resource or the [GroupService/SetAccessBindings](../api-ref/grpc/Group/setAccessBindings.md) gRPC API call. In your request, provide an array of objects, each one matching a particular role and containing the following data:

   * Role in the `accessBindings[].roleId` parameter.
   * ID of the subject getting the roles in the `accessBindings[].subject.id` parameter.
   * Type of the subject getting the roles in the `accessBindings[].subject.type` parameter.

{% endlist %}

## Revoking a role {#remove-access-binding}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) as the organization administrator or owner.

  1. In the left-hand panel, select ![groups](../../_assets/console-icons/persons.svg) **Groups** and click the line with the [group](../concepts/groups.md) name.
  
  1. Navigate to the **Group access rights** tab.

  1. To revoke roles:

      1. In the row with the user, service account, or group, click ![image](../../_assets/console-icons/ellipsis.svg) and select **Configure access**.

      1. Click ![image](../../_assets/console-icons/xmark.svg) next to the roles you want to revoke.

      1. Click **Save**.

  1. To revoke all roles, in the row with the user, service account, or group, click ![image](../../_assets/console-icons/ellipsis.svg) and select ![TrashBin](../../_assets/console-icons/trash-bin.svg) **Revoke access**. Confirm the action.

- CLI {#cli}

   If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

   The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

   1. See the description of the CLI command to revoke a role:

       ```bash
       yc organization-manager group remove-access-binding --help
       ```

   1. Get a list of user groups with their IDs:

       ```bash
       yc organization-manager group list \
         --organization-id <organization_ID>
       ```

   1. Get the [ID of the user](users-get.md), [service account](../../iam/operations/sa/get-id.md), or user group you are revoking a role from.
   1. Use the `yc organization-manager group remove-access-binding` command to revoke a role from an object:

         ```bash
         yc organization-manager group remove-access-binding \
           --id <group_ID> \
           --role <role> \
           --user-account-id <user_ID> \
           --federation-users <user_ID> \
           --service-account-id <service_account_ID> \
           --subject group:<group_ID>
         ```

         Where:

         * `--id`: User group ID.
         * `--role`: Role ID.
         
         ID of the object to revoke a role from:
         
         * `--user-account-id`: Yandex account ID.
         * `--federation-users`: Federated user ID.
         * `--service-account-id`: Service account ID.
         * `--subject group`: Group ID.

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  To revoke a role from a user, service account, or user group:

  1. Open the Terraform configuration file and remove the part containing the `yandex_organizationmanager_group_iam_binding` resource for the role you want to revoke.

      ```hcl
      resource "yandex_organizationmanager_group_iam_binding" "editor" {
        group_id = "<group_ID>"
        role     = "<role_ID>"
        members  = [
          "<subject_type>:<subject_ID>",
        ]
      }
      ```

  1. Apply the changes:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.
   
  The role will be revoked from the subject you indicated. You can check the role is no longer assigned using the [Cloud Center UI](https://center.yandex.cloud/organization).

- API {#api}

   Use the [updateAccessBindings](../api-ref/Group/updateAccessBindings.md) method for the [Group](../api-ref/Group/index.md) resource or the [GroupService/UpdateAccessBindings](../api-ref/grpc/Group/updateAccessBindings.md) gRPC API call and provide the following in the request:

   * `REMOVE` in the `accessBindingDeltas[].action` parameter to revoke the role.
   * Role in the `accessBindingDeltas[].accessBinding.roleId` parameter.
   * ID of the subject to revoke the role from in the `accessBindingDeltas[].accessBinding.subject.id` parameter.
   * Type of the subject to revoke the role from in the `accessBindingDeltas[].accessBinding.subject.type` parameter.

{% endlist %}