[Yandex Cloud documentation](../../index.md) > [Yandex Identity Hub](../index.md) > [Step-by-step guides](index.md) > Access management > Assigning a role to a user group

# Assigning a role to a user group

Assign a role to a [user group](manage-groups.md) to grant access to a resource. To grant group access permissions to a [subject](../../iam/concepts/access-control/index.md#subject), see [Configuring group management access](access-manage-group.md).

In Yandex Identity Hub, you can assign a group a role for an organization, cloud, folder, another group, or service account.

## Assigning a role for a cloud or folder {#access-binding-cloud}

{% list tabs group=instructions %}

- Management console {#console}

  1. Log in to the [management console](https://console.yandex.cloud) with the cloud administrator or owner account.

  1. On the left side of the screen, click the line with the name of the [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud) or [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for which you want to assign a role to a user group.

  1. At the top of the screen, go to the **Access bindings** tab and click **Configure access**. In the window that opens:

      1. Go to the **Groups** tab and select the [group](../concepts/groups.md) you need or search by group name.

          You can also assign a role to one of the [system](../../iam/concepts/access-control/system-group.md) groups:

          * `All users in organization X`: The group includes all users in organization `X`.
          * `All users in federation N`: The group includes all users in federation `N`.

      1. Click ![plus](../../_assets/console-icons/plus.svg) **Add role** and select the [role](../../iam/concepts/access-control/roles.md) you want to assign to the group for the cloud or folder you selected earlier. You can assign multiple roles.

      1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  1. Select a [role](../../iam/concepts/access-control/roles.md) from the [Yandex Cloud role reference](../../iam/roles-reference.md).
  1. Assign the role using this command:

     ```bash
     yc <service_name> <resource> add-access-binding <resource_name_or_ID> \
       --role <role_ID> \
       --subject group:<group_ID>
     ```

     Where:
     
     * `--role`: Role ID, e.g., `resource-manager.clouds.owner`.
     * `--subject group`: ID of the [group](../concepts/groups.md) the role is assigned to.

         To assign a role to one of the [system groups](../../iam/concepts/access-control/system-group.md), instead of `--subject`, use the `--organization-users <organization_ID>` or `--federation-users <federation_ID>` parameter. In the parameter, provide the ID of the [organization](../quickstart.md) or [identity federation](../concepts/add-federation.md), respectively, to all the users you want to assign the role to.
         
         You can also assign a role to a system group using the `--subject` parameter. To do this, provide in it the [subject](../../iam/concepts/access-control/index.md#subject) ID matching the selected system group.

     For example, assign the `resource-manager.viewer` role for the `my-cloud` [cloud](../../resource-manager/concepts/resources-hierarchy.md#folder):

     ```bash
     yc resource-manager cloud add-access-binding mycloud \
       --role resource-manager.viewer \
       --subject group:aje6o61dvog2********
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Add the resource parameters to the configuration file and specify the required [role](../../iam/concepts/access-control/roles.md) and [group](../concepts/groups.md):

     ```hcl
     resource "yandex_resourcemanager_cloud_iam_member" "admin" {
       cloud_id    = "<cloud_ID>"
       role        = "<role_ID>"
       member      = "group:<group_ID>"
     }
     ```

     Where:
     
     * `cloud_id`: [Cloud ID](../../resource-manager/operations/cloud/get-id.md). You can also assign a role within an individual [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). To do this, specify `folder_id` instead of `cloud_id` and the required folder ID in the resource parameters.
     * `role`: Role to assign. This is a required parameter.
     * `member`: Group the role is assigned to. Use this format: `group:<group_ID>`. This is a required parameter.

         To assign a role to one of the [system groups](../../iam/concepts/access-control/system-group.md), specify the following in the `member` parameter:

         * `system:group:organization:<organization_ID>:users`: To assign a role to the `All users in organization X` system group.
         * `system:group:federation:<federation_ID>:users`: To assign a role to the `All users in federation N` system group.

     For more information about the `yandex_resourcemanager_cloud_iam_member` resource parameters, see [this Terraform article](../../terraform/resources/iam_service_account_iam_member.md).
  1. Create the resources:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     This will create all the resources you need in the specified folder. You can check the new resource using the [management console](https://console.yandex.cloud) or this [CLI](../../cli/index.md) command:

     ```bash
     terraform plan
     ```

     If the configuration is correct, the terminal will display a list of the resources being created and their parameters. If the configuration contains any errors, Terraform will point them out.
  1. Deploy the cloud resources.
     1. If the configuration does not contain any errors, run this command:

        ```bash
        terraform apply
        ```

     1. Confirm creating the resources: type `yes` in the terminal and press **Enter**.

     This will create all the resources you need in the specified folder. You can check the new resource using the [management console](https://console.yandex.cloud) or this CLI command:

     ```bash
     yc resource-manager folder list-access-bindings <folder_name_or_ID>
     ```

- API {#api}

  Use the `updateAccessBindings` REST API method for the appropriate resource.
  1. Select a [role](../../iam/concepts/access-control/roles.md) from the [Yandex Cloud role reference](../../iam/roles-reference.md).
  1. Create the request body, e.g., in the `body.json` file. In the `action` property, enter `ADD`, and specify the `group` type and group ID under `subject`:

     **body.json:**

     ```json
     {
       "accessBindingDeltas": [{
         "action": "ADD",
         "accessBinding": {
           "roleId": "editor",
           "subject": {
             "id": "<group_ID>",
             "type": "group"
           }
         }
       }]
     }
     ```

  1. Assign a role to a service account. For example, for a folder with the `b1gvmob95yys********` ID:
     
     ```bash
     export FOLDER_ID=b1gvmob95yys********
     export IAM_TOKEN=CggaAT********
     curl \
       --request POST \
       --header "Content-Type: application/json" \
       --header "Authorization: Bearer ${IAM_TOKEN}" \
       --data '@body.json' \
       "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:updateAccessBindings"
     ```

  To learn how to assign a role for the respective resource, see:
  * [Setting up service account access permissions](../../iam/operations/sa/set-access-bindings.md).
  * [Setting up cloud access permissions](../../resource-manager/operations/cloud/set-access-bindings.md).
  * [Setting up folder access permissions](../../resource-manager/operations/folder/set-access-bindings.md).

{% endlist %}

## Assigning a role for an organization {#access-binding-organization}

{% list tabs group=instructions %}

- Cloud Center UI {#cloud-center}

  1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization) using an administrator or organization owner account.

  1. In the left-hand panel, select ![persons-lock](../../_assets/console-icons/persons-lock.svg) **Access bindings**.

  1. At the top right, click **Assign roles**.

  1. Go to the **Groups** tab and select the [group](../concepts/groups.md) you need or search by group name.

     You can also assign a role to one of the [system](../../iam/concepts/access-control/system-group.md) groups:

     * `All users in organization X`: The group includes all users in organization `X`.
     * `All users in federation N`: The group includes all users in federation `N`.

  1. Click ![plus](../../_assets/console-icons/plus.svg) **Add role** and select the [role](../../iam/concepts/access-control/roles.md) for the organization you want to assign to the group. You can assign multiple roles.

  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  1. Assign the [role](../../iam/concepts/access-control/roles.md) to the [group](../concepts/groups.md):

     ```bash
     yc organization-manager organization add-access-binding \
       --subject group:<group_ID> \
       --role <role_ID> \
       --organization-users <organization_ID> \
       --federation-users <federation_ID>
     ```

     To assign a role to one of the [system groups](../../iam/concepts/access-control/system-group.md), instead of the `--subject` parameter, use `--organization-users <organization_ID>` or `--federation-users <federation_ID>`. In the parameter, provide the [organization](../quickstart.md) or [identity federation](../concepts/add-federation.md) ID to all the users you want to assign the role to.
         
     You can also assign a role to a system group using the `--subject` parameter. To do this, provide in it the [subject](../../iam/concepts/access-control/index.md#subject) ID matching the selected system group.

  1. Make sure the requested permissions are granted:

     ```bash
     yc organization-manager organization list-access-bindings <organization_ID>
     ```

     A response contains a list of all roles assigned to users and groups in the organization:

     ```text
     +------------------------------------------+--------------+----------------------+
     |                 ROLE ID                  | SUBJECT TYPE |      SUBJECT ID      |
     +------------------------------------------+--------------+----------------------+
     | organization-manager.admin               | userAccount  | ajev1p2345lj******** |
     | organization-manager.organizations.owner | userAccount  | ajev1p2345lj******** |
     | editor                                   | group        | ajev1p2345lj******** |
     | viewer                                   | group        | ajev1p2345lj******** |
     +------------------------------------------+--------------+----------------------+
     ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../terraform/authentication.md) using the appropriate method.

  1. Add the resource parameters to the configuration file and specify the required [role](../../iam/concepts/access-control/roles.md) and [group](../concepts/groups.md):

     ```hcl
     resource "yandex_organizationmanager_organization_iam_member" "users-editors" {
       organization_id = "<organization_ID>"
       role            = "<role_ID>"
       member          = "group:<group_ID>"
     }
     ```

     Where:
     
     * `organization_id`: [Organization ID](organization-get-id.md). This is a required setting.
     * `role`: Role being assigned. This is a required setting.
     * `member`: Group the role is assigned to. Use this format: `group:<group_ID>`. This is a required setting.

         To assign a role to one of the [system groups](../../iam/concepts/access-control/system-group.md), specify the following in the `member` parameter:

         * `system:group:organization:<organization_ID>:users`: To assign a role to the `All users in organization X` system group.
         * `system:group:federation:<federation_ID>:users`: To assign a role to the `All users in federation N` system group.

     For more information about `yandex_organizationmanager_organization_iam_member` properties, see [this provider guide](../../terraform/resources/organizationmanager_organization_iam_member.md).
  1. Create the resources:

     1. In the terminal, navigate to the configuration file directory.
     1. Make sure the configuration is correct using this command:
     
        ```bash
        terraform validate
        ```
     
        If the configuration is valid, you will get this message:
     
        ```bash
        Success! The configuration is valid.
        ```
     
     1. Run this command:
     
        ```bash
        terraform plan
        ```
     
        You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.
     1. Apply the configuration changes:
     
        ```bash
        terraform apply
        ```
     
     1. Type `yes` and press **Enter** to confirm the changes.

     This will create all the resources you need in the specified [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). You can check the new resources in the [Cloud Center UI](https://center.yandex.cloud/organization) or using this [CLI](../../cli/index.md) command:

     ```bash
     yc resource-manager folder list-access-bindings <folder_name_or_ID>
     ```

{% endlist %}

#### See also {#see-also}

* [Setting up service account access permissions](../../iam/operations/sa/set-access-bindings.md)
* [Setting up cloud access permissions](../../resource-manager/operations/cloud/set-access-bindings.md)
* [Setting up folder access permissions](../../resource-manager/operations/folder/set-access-bindings.md)