[Yandex Cloud documentation](../../../index.md) > [Yandex Resource Manager](../../index.md) > [Step-by-step guides](../index.md) > Folder > Managing access policies

# Managing folder access policies

{% note info %}

This feature is in the [Preview](../../../overview/concepts/launch-stages.md) stage. To get access, contact [tech support](https://center.yandex.cloud/support) or your account manager.

{% endnote %}

[Access policies](../../../iam/concepts/access-control/access-policies.md) are a Yandex Identity and Access Management mechanism that allows you to manage permissions for specific operations with [Yandex Cloud resources](../../../overview/roles-and-resources.md). Access policies are based on [templates](../../../iam/concepts/access-control/access-policies.md#supported-policies) and complement the [role](../../../iam/concepts/access-control/roles.md) system for more flexible [access management](../../../iam/concepts/access-control/index.md).

A [folder’s](../../concepts/resources-hierarchy.md#folder) access policies can be managed by users with the [`resource-manager.admin`](../../security/index.md#resource-manager-admin) or [`admin`](../../../iam/roles-reference.md#admin) role for the folder.

## Creating an access policy for a folder {#assign}

To create a [folder](../../concepts/resources-hierarchy.md#folder) access policy from a [template without parameters](../../../iam/concepts/access-control/access-policies.md#fixed):

{% list tabs group=instructions %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  1. [Get](../../../iam/operations/access-policies/list.md) a list of supported access policy templates with their IDs.
  1. Run this command:

      ```bash
      yc resource-manager folder bind-access-policy \
        --name <folder_name> \
        --access-policy-template-id=<policy_template_ID>
      ```

      Where:

      * `--name`: Name of the folder to create the policy for. Instead of the folder name, you can provide its [ID](get-id.md) in the `--id` parameter.
      * `--access-policy-template-id`: ID of the template to use as the basis for the new access policy for the folder.
  1. [Make sure](manage-access-policies.md#view-assigned) the policy was created.

- API {#api}

  Use the [bindAccessPolicy](../../api-ref/Folder/bindAccessPolicy.md) REST API method for the [Folder](../../api-ref/Folder/index.md) resource or the [FolderService/BindAccessPolicy](../../api-ref/grpc/Folder/bindAccessPolicy.md) gRPC API call.

{% endlist %}

The created access policy will apply to all resources in the specified folder.

## Viewing the list of your folder’s access policies {#view-assigned}

To view a list of access policies created for a [folder](../../concepts/resources-hierarchy.md#folder):

{% list tabs group=instructions %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  Run this command by specifying the name or [ID](get-id.md) of the folder for which you want to view the new policies:

  ```bash
  yc resource-manager folder list-access-policy-bindings <folder_name_or_ID>
  ```

  Result:

  ```
  +---------------------------------------------+-------------------------------------------------+
  |          ACCESS POLICY TEMPLATE ID          |                   PARAMETERS                    |
  +---------------------------------------------+-------------------------------------------------+
  | backup.denyRemoveProtection                 |                                                 |
  | serverless.containers.restrictNetworkAccess | allowed_vpc_network_ids=[enphfcfseu9i********], |
  |                                             | allowed_src_ips=[192.168.1.12/24]               |
  +---------------------------------------------+-------------------------------------------------+
  ```

- API {#api}

  Use the [listAccessPolicyBindings](../../api-ref/Folder/listAccessPolicyBindings.md) REST API method for the [Folder](../../api-ref/Folder/index.md) resource or the [FolderService/ListAccessPolicyBindings](../../api-ref/grpc/Folder/listAccessPolicyBindings.md) gRPC API call.

{% endlist %}

## Deleting an access policy created for a folder {#revoke}

To delete an access policy created for a [folder](../../concepts/resources-hierarchy.md#folder):

{% list tabs group=instructions %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  1. [Get](manage-access-policies.md#view-assigned) a list of IDs of access policy templates assigned for the folder.
  1. Run this command:

      ```bash
      yc resource-manager folder unbind-access-policy \
        --name <folder_name> \
        --access-policy-template-id=<policy_template_ID>
      ```

      Where:

      * `--name`: Name of the folder that you want to delete the policy for. Instead of the folder name, you can provide its [ID](get-id.md) in the `--id` parameter.
      * `--access-policy-template-id`: ID of the access policy template you want to delete for the specified folder.
  1. [Make sure](manage-access-policies.md#view-assigned) the policy was deleted.

- API {#api}

  Use the [unbindAccessPolicy](../../api-ref/Folder/unbindAccessPolicy.md) REST API method for the [Folder](../../api-ref/Folder/index.md) resource or the [FolderService/UnbindAccessPolicy](../../api-ref/grpc/Folder/unbindAccessPolicy.md) gRPC API call.

{% endlist %}

The specified access policy will no longer apply to resources in the specified folder.

#### Useful links {#see-also}

* [Access policies](../../../iam/concepts/access-control/access-policies.md)