[Yandex Cloud documentation](../../../index.md) > [Yandex Resource Manager](../../index.md) > [Step-by-step guides](../index.md) > Folder > Setting up access rights

# Setting up folder access permissions

{% note warning %}

Even if an [operation](../../../api-design-guide/concepts/about-async.md) with resources pertaining to Yandex Cloud [services](../../../overview/concepts/services.md) is allowed by a [role](../../../iam/concepts/access-control/roles.md), it may still be blocked if the [organization](../../../organization/concepts/organization.md), [cloud](../../concepts/resources-hierarchy.md#cloud), or [folder](../../concepts/resources-hierarchy.md#folder) is subject to an [access policy](../../../iam/concepts/access-control/access-policies.md) prohibiting this operation.

{% endnote %}

To grant a user access to [folder](../../concepts/resources-hierarchy.md#folder) resources, assign the user a [role](../../../iam/concepts/access-control/roles.md) for the folder.

{% note info %}

To enable a user to access the [management console](https://console.yandex.cloud), assign them a role for the [cloud](../../../organization/security/index.md#access-binding-cloud). For added security, you can assign one of the least priveleged roles, such as `resource-manager.clouds.member`. However, you may also assign other roles if you know which permissions you want to grant to the invited users.

To grant these permissions to all the organization users at once, assign the role to the `All users in organization X` [system group](../../../iam/concepts/access-control/system-group.md#allOrganizationUsers). When using the CLI, API, or Terraform, no additional roles are required.

{% endnote %}

## Assigning a role for a folder {#access-to-user}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../../_assets/console-icons/chevron-down.svg) in the top panel and select the [folder](../../concepts/resources-hierarchy.md#folder).
  1. Navigate to the **Access bindings** tab.
  1. Click **Configure access**.
  1. In the window that opens, select **User accounts**.
  1. Select a user from the list or use the user search option.
  1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the role from the list or use the search bar.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  1. View the description of the command to assign a role for a folder:

      ```bash
      yc resource-manager folder add-access-binding --help
      ```

  1. Select a folder, e.g., `my-folder`:

      ```bash
      yc resource-manager folder list
      ```

      Result:

      ```
      +----------------------+-----------+--------+--------+
      |          ID          |   NAME    | LABELS | STATUS |
      +----------------------+-----------+--------+--------+
      | b1gd129pp9ha******** | my-folder |        | ACTIVE |
      +----------------------+-----------+--------+--------+
      ```

  1. Choose the [role](../../../iam/concepts/access-control/roles.md).

      ```bash
      yc iam role list
      ```

      Result:


      ```
      +--------------------------------+-------------+
      |               ID               | DESCRIPTION |
      +--------------------------------+-------------+
      | admin                          |             |
      | compute.images.user            |             |
      | editor                         |             |
      | ...                            |             |
      +--------------------------------+-------------+
      ```

  1. Find out the user ID from the login or email address.

      ```bash
      yc iam user-account get test-user
      ```

      Result:

      ```text
      id: gfei8n54hmfh********
      yandex_passport_user_account:
        login: test-user
        default_email: test-user@yandex.ru
      ```

  1. Assign the `editor` role to `test-user` for `my-folder`. In the subject, specify the `userAccount` type and user ID:

      ```bash
      yc resource-manager folder add-access-binding my-folder \
        --role editor \
        --subject userAccount:gfei8n54hmfh********
      ```

  To assign a role to a [service account](../../../iam/concepts/users/service-accounts.md), [user group](../../../organization/concepts/groups.md), or [system group](../../../iam/concepts/access-control/system-group.md) instead of a user, see [these examples](../../../iam/operations/roles/grant.md#cloud-or-folder).

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  {% note alert %}

  Do not create the resource along with `yandex_resourcemanager_folder_iam_policy`, since this may cause conflicts.

  {% endnote %}

  To assign a role to a folder created using Terraform:

  1. Describe the parameters of the folder role in a configuration file:

     * `folder_id`: [ID of the folder](get-id.md) to grant permissions for. This is a required setting.
     * `role`: Role being assigned. This is a required setting.

       {% note info %}

       For each role, you can only use one `yandex_resourcemanager_folder_iam_member` resource.

       {% endnote %}

     * `member`: User to assign the role to. This is a required setting. It may have one of the following values:
       * `userAccount:<user_ID>`: [User ID](../../../organization/operations/users-get.md).
       * `serviceAccount:<service_account_ID>`: [Service account ID](../../../iam/operations/sa/get-id.md).
       * `federatedUser:<user_account_ID>`: [User account ID](../../../organization/operations/users-get.md).
       * `system:group:organization:<organization_ID>:users`: [Organization](../../../organization/quickstart.md) ID to assign a role to the `All users in organization X` [system group](../../../iam/concepts/access-control/system-group.md#allOrganizationUsers).
       * `system:group:federation:<federation_ID>:users`: [Identity federation](../../../organization/concepts/add-federation.md) ID to assign a role to the `All users in federation N` [system group](../../../iam/concepts/access-control/system-group.md#allFederationUsers).

     {% cut "Example of assigning roles to a folder using Terraform" %}

     ```hcl
     ...
     data "yandex_resourcemanager_folder" "project1" {
       folder_id = "<folder_ID>"
     }

     resource "yandex_resourcemanager_folder_iam_member" "editor" {
       folder_id = "${data.yandex_resourcemanager_folder_iam_member.project1.id}"
       role      = "editor"
       member    = "userAccount:<login@yandex.ru>"
     }
     ...
     ```

     {% endcut %}

     For more on the properties of the `yandex_resourcemanager_folder_iam_member` in Terraform, see [this provider guide](../../../terraform/resources/resourcemanager_folder_iam_member.md).

  1. Validate your configuration using this command:
     ```
     terraform validate
     ```

     If the configuration is valid, you will get this message:

     ```
     Success! The configuration is valid.
     ```

  1. Run this command:
     ```
     terraform plan
     ```

     You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

  1. Apply the configuration changes:
     ```
     terraform apply
     ```

  1. Confirm the changes: type `yes` into the terminal and press **Enter**.

     You can check the folder update using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/quickstart.md) command:

     ```
     yc resource-manager folder list-access-bindings <folder_name_or_ID>
     ```

- API {#api}

  Use the [updateAccessBindings](../../api-ref/Folder/updateAccessBindings.md) REST API method for the [Folder](../../api-ref/Folder/index.md) resource or the [FolderService/UpdateAccessBindings](../../api-ref/grpc/Folder/updateAccessBindings.md) gRPC API call. You will need the folder ID and the ID of the user to whom you want to assign the role for the folder.

  1. Find out the folder ID using the [list](../../api-ref/Folder/list.md) REST API method:
      ```bash
      curl \
        --header "Authorization: Bearer <IAM_token>" \
        https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders?cloudId=b1gg8sgd16g7********
      ```

      Result:

      ```json
      {
       "folders": [
        {
         "id": "b1g66mft1vop********",
         "cloudId": "b1gd129pp9ha********",
         "createdAt": "2018-10-17T12:44:31Z",
         "name": "my-folder",
         "status": "ACTIVE"
        }
       ]
      }
      ```

  1. Find out the user ID from the login using the [getByLogin](../../../iam/api-ref/YandexPassportUserAccount/getByLogin.md) REST API method:
      ```bash
      curl \
        --header "Authorization: Bearer <IAM_token>" \
        https://iam.api.cloud.yandex.net/iam/v1/yandexPassportUserAccounts:byLogin?login=test-user
      ```

      Result:

      ```json
      {
       "id": "gfei8n54hmfh********",
       "yandexPassportUserAccount": {
        "login": "test-user",
        "defaultEmail": "test-user@yandex.ru"
       }
      }
      ```

  1. Assign the `editor` role to the user for `my-folder`. Set the `action` property to `ADD` and specify the `userAccount` type and user ID in the `subject` property:

      ```bash
      curl \
        --request POST \
        --header 'Content-Type: application/json' \
        --header "Authorization: Bearer <IAM_token>" \
        --data '{
        "accessBindingDeltas": [{
            "action": "ADD",
            "accessBinding": {
                "roleId": "editor",
                "subject": {
                    "id": "gfei8n54hmfh********",
                    "type": "userAccount"
        }}}]}' \
        https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/b1gd129pp9ha********:updateAccessBindings
      ```

{% endlist %}


## Assigning multiple roles {#multiple-roles}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../../_assets/console-icons/chevron-down.svg) in the top panel and select the [folder](../../concepts/resources-hierarchy.md#folder).
  1. Navigate to the **Access bindings** tab.
  1. Click **Configure access**.
  1. In the window that opens, select **User accounts**.
  1. Select a user from the list or use the user search option.
  1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the role from the list or use the search bar.
  1. Repeat this step as many times as you need to add all the required roles.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The `add-access-binding` command allows you to add only one role. You can assign multiple roles using the `set-access-binding` command.

  {% note alert %}

  The `set-access-binding` command completely overwrites access permissions for the resource! All roles previously assigned for this resource will be deleted.

  {% endnote %}

  1. Make sure the resource has no important roles assigned before proceeding:
      ```bash
      yc resource-manager folder list-access-bindings my-folder
      ```
  1. For example, assign a role to multiple users:

      ```bash
      yc resource-manager folder set-access-bindings my-folder \
        --access-binding role=editor,subject=userAccount:gfei8n54hmfh********
        --access-binding role=viewer,subject=userAccount:helj89sfj80a********
      ```

  To assign a role to a [service account](../../../iam/concepts/users/service-accounts.md), [user group](../../../organization/concepts/groups.md), or [system group](../../../iam/concepts/access-control/system-group.md) instead of a user, see [these examples](../../../iam/operations/roles/grant.md#multiple-roles).

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  {% note alert %}

  Do not create the resource along with `yandex_resourcemanager_folder_iam_policy`, since this may cause conflicts.

  {% endnote %}

  To assign several roles to a folder created with Terraform:

  1. Describe the parameters of the folder role in a configuration file:

     * `folder_id`: [ID of the folder](get-id.md) to grant permissions for. This is a required setting.
     * `role`: Role being assigned. This is a required setting.

       {% note info %}

       For each role, you can only use one `yandex_resourcemanager_folder_iam_member` resource.

       {% endnote %}

     * `member`: User to assign the role to. To add a user to the list, create an entry in this format: `userAccount:<user_ID>`, where `<user_ID>` is the email address of a Yandex account, e.g., `ivan@yandex.ru`. This is a required setting.

     {% cut "Example of assigning roles to a folder using Terraform" %}

     ```hcl
     ...
     data "yandex_resourcemanager_folder" "project1" {
       folder_id = "<folder_ID>"
     }

     resource "yandex_resourcemanager_folder_iam_member" "editor" {
       folder_id = "${data.yandex_resourcemanager_folder.project1.id}"
       role      = "editor"
       member    = "userAccount:<login1@yandex.ru>"
     }
     resource "yandex_resourcemanager_folder_iam_member" "operator" {
       folder_id = "${data.yandex_resourcemanager_folder.project1.id}"
       role      = "operator"
       member    = "userAccount:<login1@yandex.ru>"
     }
     ...
     ```

     {% endcut %}

     For more on the properties of the `yandex_resourcemanager_folder_iam_member` in Terraform, see [this provider guide](../../../terraform/resources/resourcemanager_folder_iam_member.md).

  1. Validate your configuration using this command:
     ```
     terraform validate
     ```

     If the configuration is valid, you will get this message:

     ```
     Success! The configuration is valid.
     ```

  1. Run this command:
     ```
     terraform plan
     ```

     You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

  1. Apply the configuration changes:
     ```
     terraform apply
     ```

  1. Confirm the changes: type `yes` into the terminal and press **Enter**.

     You can check the folder update using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/quickstart.md) command:

     ```
     yc resource-manager folder list-access-bindings <folder_name_or_ID>
     ```

- API {#api}

  Assign the `editor` role to one user and the `viewer` role to another user:

  ```bash
  curl \
    --request POST \
    --header 'Content-Type: application/json' \
    --header "Authorization: Bearer <IAM_token>" \
    --data '{
    "accessBindingDeltas": [{
        "action": "ADD",
        "accessBinding": {
            "roleId": "editor",
            "subject": {
                "id": "gfei8n54hmfh********",
                "type": "userAccount"
            }
        }
    },{
        "action": "ADD",
        "accessBinding": {
            "roleId": "viewer",
            "subject": {
                "id": "helj89sfj80a********",
                "type": "userAccount"
    }}}]}' \
    https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/b1gd129pp9ha********:updateAccessBindings
  ```

  You can also assign roles using the [setAccessBindings](../../api-ref/Folder/setAccessBindings.md) REST API method for the [Folder](../../api-ref/Folder/index.md) resource or the [FolderService/SetAccessBindings](../../api-ref/grpc/Folder/setAccessBindings.md) gRPC API call.

  {% note alert %}

  The `setAccessBindings` method completely overwrites access permissions for the resource! All roles previously assigned for this resource will be deleted.

  {% endnote %}

  ```bash
  curl \
    --request POST \
    --header 'Content-Type: application/json' \
    --header "Authorization: Bearer <IAM_token>" \
    --data '{
    "accessBindings": [{
        "roleId": "editor",
        "subject": { "id": "ajei8n54hmfh********", "type": "userAccount" }
    },{
        "roleId": "viewer",
        "subject": { "id": "helj89sfj80a********", "type": "userAccount" }
    }]}' \
    https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/b1gd129pp9ha********:setAccessBindings
  ```

{% endlist %}


## Folder access for a service account {#access-to-sa}

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../../_assets/console-icons/chevron-down.svg) in the top panel and select the [folder](../../concepts/resources-hierarchy.md#folder).
  1. Navigate to the **Access bindings** tab.
  1. Click **Configure access**.
  1. In the window that opens, select **Service accounts**.
  1. Select a service account from the list or use the search.
  1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the role in the folder.
  1. Click **Save**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  1. Select the role to assign to the service account. You can find the description of the roles in the Yandex Identity and Access Management documentation in the [Yandex Cloud role reference](../../../iam/roles-reference.md).
  
  1. Find out the service account ID by its name:
  
      ```bash
      yc iam service-account get my-robot
      ```
  
      Result:
  
      ```text
      id: aje6o61dvog2********
      folder_id: b1gvmob95yys********
      created_at: "2018-10-15T18:01:25Z"
      name: my-robot
      ```
  
      If you don't know the name of the service account, get a list of service accounts with their IDs:
  
      ```bash
      yc iam service-account list
      ```
  
      Result:
  
      ```bash
      +----------------------+------------------+-----------------+
      |          ID          |       NAME       |   DESCRIPTION   |
      +----------------------+------------------+-----------------+
      | aje6o61dvog2******** | my-robot         | my description  |
      +----------------------+------------------+-----------------+
      ```
  
  1. Assign the `viewer` role to the `my-robot` service account using its ID:
  
      ```bash
      yc resource-manager folder add-access-binding my-folder \
        --role viewer \
        --subject serviceAccount:aje6o61dvog2********
      ```

- Terraform {#tf}

  If you do not have Terraform yet, [install it and configure the Yandex Cloud provider](../../../tutorials/infrastructure-management/terraform-quickstart.md#install-terraform).
  
  
  To manage infrastructure using Terraform under a service account or user accounts (a Yandex account, a federated account, or a local user), [authenticate](../../../terraform/authentication.md) using the appropriate method.

  {% note alert %}

  Do not create the resource along with `yandex_resourcemanager_folder_iam_policy`, since this may cause conflicts.

  {% endnote %}

  To assign a service account a role for a folder created with Terraform:

  1. Describe the parameters of the folder role in a configuration file:

     * `folder_id`: [ID of the folder](get-id.md) to grant permissions for. This is a required setting.
     * `role`: Role being assigned. This is a required setting.

       {% note info %}

       For each role, you can only use one `yandex_resourcemanager_folder_iam_member` resource.

       {% endnote %}

     * `member`: User to assign the role to. To add a user to the list, create a record in this format: `serviceAccount:<service_account_ID>`, where `<service_account_ID>` is the [service account ID](../../../iam/operations/sa/get-id.md). You can list several service accounts. This is a required setting.

     {% cut "Example of assigning roles to a folder using Terraform" %}

     ```hcl
     ...
     data "yandex_resourcemanager_folder" "project1" {
       folder_id = "<folder_ID>"
     }

     resource "yandex_resourcemanager_folder_iam_member" "editor" {
       folder_id = "${data.yandex_resourcemanager_folder.project1.id}"
       role      = "editor"
       member   = "serviceAccount:<service_account_ID>"
     }
     ...
     ```

     {% endcut %}

     For more on the properties of the `yandex_resourcemanager_folder_iam_member` in Terraform, see [this provider guide](../../../terraform/resources/resourcemanager_folder_iam_member.md).

  1. Validate your configuration using this command:
     ```
     terraform validate
     ```

     If the configuration is valid, you will get this message:

     ```
     Success! The configuration is valid.
     ```

  1. Run this command:
     ```
     terraform plan
     ```

     You will see a list of resources and their properties. No changes will be made at this step. Terraform will show any errors in the configuration.

  1. Apply the configuration changes:
     ```
     terraform apply
     ```

  1. Confirm the changes: type `yes` into the terminal and press **Enter**.

     You can check the folder update using the [management console](https://console.yandex.cloud) or this [CLI](../../../cli/quickstart.md) command:

     ```
     yc resource-manager folder list-access-bindings <folder_name_or_ID>
     ```

- API {#api}

  To assign the service account a role for a cloud or folder, use the `updateAccessBindings` REST API method for the [Cloud](../../api-ref/Cloud/index.md) or [Folder](../../api-ref/Folder/index.md) resource:
  
  1. Select the role to assign to the service account. You can find the description of the roles in the Yandex Identity and Access Management documentation in the [Yandex Cloud role reference](../../../iam/roles-reference.md).
  1. [Get](get-id.md) the ID of the service accounts folder.
  1. [Get](../../../iam/operations/iam-token/create.md) an IAM token for authentication in the Yandex Cloud API.
  1. Get a list of folder service accounts to find out their IDs:
  
      ```bash
      export FOLDER_ID=b1gvmob95yys********
      export IAM_TOKEN=CggaATEVAgA...
      curl \
        --header "Authorization: Bearer ${IAM_TOKEN}" \
        "https://iam.api.cloud.yandex.net/iam/v1/serviceAccounts?folderId=${FOLDER_ID}"
      ```
  
      Result:
  
  
      ```json
      {
       "serviceAccounts": [
        {
         "id": "ajebqtreob2d********",
         "folderId": "b1gvmob95yys********",
         "createdAt": "2018-10-18T13:42:40Z",
         "name": "my-robot",
         "description": "my description"
        }
       ]
      }
      ```
  
  1. Create the request body, e.g., in the `body.json` file. Set the `action` property to `ADD` and `roleId` to the appropriate role, such as `editor`, and specify the `serviceAccount` type and service account ID in the `subject` property:
  
      **body.json:**
      ```json
      {
        "accessBindingDeltas": [{
          "action": "ADD",
          "accessBinding": {
            "roleId": "editor",
            "subject": {
              "id": "ajebqtreob2d********",
              "type": "serviceAccount"
            }
          }
        }]
      }
      ```
  1. Assign a role to a service account. For example, for a folder with the `b1gvmob95yys********` ID:
     
     ```bash
     export FOLDER_ID=b1gvmob95yys********
     export IAM_TOKEN=CggaAT********
     curl \
       --request POST \
       --header "Content-Type: application/json" \
       --header "Authorization: Bearer ${IAM_TOKEN}" \
       --data '@body.json' \
       "https://resource-manager.api.cloud.yandex.net/resource-manager/v1/folders/${FOLDER_ID}:updateAccessBindings"
     ```

{% endlist %}

## Folder access for a federated user {#access-to-federated-user}

{% list tabs group=instructions %}

- Management console {#console}

  The role assignment procedure is the same as for a user with a Yandex account. The user's federation name is shown next to the username.

  1. In the [management console](https://console.yandex.cloud), click ![image](../../../_assets/console-icons/layout-side-content-left.svg) or ![image](../../../_assets/console-icons/chevron-down.svg) in the top panel and select the [folder](../../concepts/resources-hierarchy.md#folder).
  1. Navigate to the **Access bindings** tab.
  1. Click **Configure access**.
  1. In the window that opens, select **User accounts**.
  1. Select a user from the list or use the user search option.
  1. Click ![image](../../../_assets/console-icons/plus.svg) **Add role** and select the role from the list or use the search bar.
  1. Click **Save**.

- CLI {#cli}

  1. Select a role from the [Yandex Cloud role reference](../../../iam/roles-reference.md).
  1. [Get the user ID](../../../organization/operations/users-get.md).
  1. Assign a role using this command:

      ```bash
      yc resource-manager folder add-access-binding <folder_name_or_ID> \
          --role <role_ID> \
          --subject federatedUser:<user_ID>
      ```

      Where:

      * `<folder_name_or_ID>`: Folder name or ID.
      * `--role`: Role ID, e.g., `editor`.
      * `--subject`: ID of the user account that gets the role.

      For example, assign the `editor` role to the `aje6o61dvog2********` federated user for `my-folder`:

      ```bash
      yc resource-manager folder add-access-binding my-folder \
          --role editor \
          --subject federatedUser:aje6o61dvog2********
      ```

{% endlist %}


## What's next {#what-is-next}

* [Updating a folder](update.md)
* [Yandex Cloud resource hierarchy](../../concepts/resources-hierarchy.md)