[Yandex Cloud documentation](../../index.md) > [Yandex Identity Hub](../index.md) > [Step-by-step guides](index.md) > Access management > Assigning a role to a user

# Assigning a role to a user

[Organization administrators and owners](add-org-admin.md) can assign roles in Yandex Identity Hub. You can assign to users not just organization management roles but also roles for access to your organization's connected cloud resources.

For information on roles available in Yandex Cloud and their associated permissions, please review the Yandex Identity and Access Management documentation, [Role reference Yandex Cloud](../../iam/roles-reference.md).

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) with an administrator or organization owner account.
  
  1. In the left-hand panel, select ![persons-lock](../../_assets/console-icons/persons-lock.svg) **Access bindings**.
  
  1. If the user already has at least one role, click ![icon-context-menu](../../_assets/console-icons/ellipsis.svg) and select **Assign roles** in the row with this user.
  
      If the user is not on the list, click **Assign roles** in the top-right corner. In the window that opens, select a user from the list or use the search bar.
  
  1. Click ![plus](../../_assets/console-icons/plus.svg) **Add role** and select the [role](../../iam/concepts/access-control/roles.md) you want to assign to the user. You can assign multiple roles.
  
      You can find the description of the available roles in the Yandex Identity and Access Management documentation in the [Yandex Cloud](../../iam/roles-reference.md) role reference.
  
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  1. Select the role you want to assign.

  1. [Get the user ID](users-get.md).

  1. Assign the role using this command:

      ```bash
      yc <service_name> <resource> add-access-binding <resource_name_or_ID> \
        --role <role_ID> \
        --subject <subject_type>:<subject_ID>
      ```

      Where:

      * `<service_name>`: Name of the service for whose resource you are assigning the role, e.g., `organization-manager`.
      * `<resource>`: Resource category. For an organization, it is always `organization`.
      * `<resource_name_or_ID>`: Resource name or ID. For an organization, use its [technical name](org-profile.md).
      * `--role`: Role ID.
      * `--subject`: Type and ID of the [subject](../../iam/concepts/access-control/index.md#subject) the role is assigned to.

      For example, this command assigns a user the administrator role for a directory with the `b1gmit33ngp3********` ID:

      ```bash
      yc resource-manager folder add-access-binding b1gmit33ngp3******** \
        --role resource-manager.admin \
        --subject userAccount:aje6o61dvog2********
      ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Describe the parameters of the roles you assign in the configuration file:

      ```hcl
      resource "yandex_organizationmanager_organization_iam_binding" "editor" {
        organization_id = "<organization_ID>"
        role = "<role_ID>"
        members = [
          "federatedUser:<user_ID>",
        ]
      }
      ```

      Where:

      * `organization_id`: [Organization ID](organization-get-id.md).
      * `role`: Role you want to assign. For each role, you can only use one `yandex_organization manager_organization_iam_binding` resource.
      * `members`: Array of the IDs of users to assign the role to:

        * `userAccount:<user_ID>`: ID of the user Yandex account or local user ID.
        * `federatedUser:<user_ID>`: Federated user ID.
        * `serviceAccount:<service_account_ID>`: Service account ID.
        * `group:<group_ID>`: User group ID.

      For more information about the resources you can create with Terraform, see [this provider guide](../../terraform/index.md).

  1. Create the required resources:

      1. In the terminal, navigate to the configuration file directory.
      1. Make sure the configuration is correct using this command:
      
         ```bash
         terraform validate
         ```
      
         If the configuration is valid, you will get this message:
      
         ```bash
         Success! The configuration is valid.
         ```
      
      1. Run this command:
      
         ```bash
         terraform plan
         ```
      
         You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
      1. Apply the configuration changes:
      
         ```bash
         terraform apply
         ```
      
      1. Type `yes` and press **Enter** to confirm the changes.
     
  The specified user will then get roles in the organization. You can check the role in the [Cloud Center interface](https://center.yandex.cloud/organization).

- API {#api}

  To assign a role, use the `updateAccessBindings` REST API method for the appropriate resource:

  1. Select the role you want to assign.

  1. [Get the user ID](users-get.md).

  1. Create the request body, e.g., in the `body.json` file. In the `action` property, enter `ADD` and specify the `userAccount` or `federatedUser` type and user ID under `subject`.

      ```json
      {
        "accessBindingDeltas": [{
          "action": "ADD",
          "accessBinding": {
            "roleId": "<role_ID>",
            "subject": {
              "id": "gfei8n54hmfh********",
              "type": "userAccount"
            }
          }
        }]
      }
      ```

  1. Assign the role. For example, for an organization with the `bpf3crucp1v2********` ID:

      ```bash
      export ORGANIZATION_ID=bpf3crucp1v2********
      export IAM_TOKEN=<IAM_token>
      curl \
        --request POST \
        --header "Content-Type: application/json" \
        --header "Authorization: Bearer ${IAM_TOKEN}" \
        --data '@body.json' \
        "https://organization-manager.api.cloud.yandex.net/organization-manager/v1/organizations/${ORGANIZATION_ID}:updateAccessBindings"
      ```

{% endlist %}

In a similar way, you can [assign roles](../../iam/operations/sa/assign-role-for-sa.md#binding-role-organization) for an organization to a service account.

#### See also {#see-also}

* [Setting up service account access permissions](../../iam/operations/sa/set-access-bindings.md)
* [Setting up cloud access permissions](../../resource-manager/operations/cloud/set-access-bindings.md)
* [Setting up folder access permissions](../../resource-manager/operations/folder/set-access-bindings.md)