[Yandex Cloud documentation](../../../index.md) > [Yandex Security Deck](../../index.md) > [Step-by-step guides](../index.md) > [Access Analyzer](index.md) > Access diagnostics

# Access diagnostics in Access Analyzer

{% note info %}

This feature is at the [Preview](../../../overview/concepts/launch-stages.md) stage.

{% endnote %}

[Access Analyzer](../../concepts/access-analyzer.md) enables you to centrally view a list of [subject](../../../iam/concepts/access-control/index.md#subject) and group access permissions for [organization](*organization_definition) [resources](../../../iam/concepts/access-control/resources-with-access-control.md) and revoke them as needed.

## Viewing a list of a subject’s access permissions {#view}

Only [organization members](../../../organization/concepts/membership.md) with the `organization-manager.viewer` [role](../../../organization/security/index.md#organization-manager-viewer) or higher for the organization can view access permissions in the [Security Deck interface](https://center.yandex.cloud/security/access-analyzer/).

To get a list of a subject's accesses to the organization's resources:

{% list tabs group=instructions %}


- Security Deck UI {#cloud-sd}

  1. [Log in](https://passport.yandex.com/auth) as an organization user with the `organization-manager.viewer` [role](../../../organization/security/index.md#organization-manager-viewer) or higher for the organization.
  1. Go to [Yandex Security Deck](https://center.yandex.cloud/security/).
  1. On the left panel, select ![person-gear](../../../_assets/console-icons/person-gear.svg) **Access Analyzer**, and at the top of the screen, select the [workspace](../../concepts/workspace.md).
  1. Navigate to the **Access diagnostics** tab.
  1. Click ![person-plus](../../../_assets/console-icons/person-plus.svg) **Select subject** and in the window that opens:
  
      1. Select the [user](../../../overview/roles-and-resources.md#users), [service account](../../../iam/concepts/users/accounts.md#sa), [user group](../../../organization/concepts/groups.md), [system group](../../../iam/concepts/access-control/system-group.md), or [public group](../../../iam/concepts/access-control/public-group.md) you need.

          Use search, if required.
      1. Click **Select**.
  
  This will open a list of accesses assigned to the selected subject. For each access, the list indicates the resource name/ID and type, [role](../../../iam/concepts/access-control/roles.md) assigned to the subject for that resource, and information about whether the role was assigned to the subject directly or inherited from a group to which the subject belongs.
  
  If the selected subject has multiple accesses, only some of them will be displayed. To display the remaining access permissions, click **Load more** at the bottom of the page.
  
  Use filtering by resource ID, role ID, or access assignment method (`Directly appointed` or `Assigned via group`) as needed.


- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`.
  
  If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command to get a list of subject’s accesses:

     ```bash
     yc iam access-analyzer list-subject-access-bindings --help
     ```

  1. Get the ID of a [user](../../../organization/operations/users-get.md), [service account](../../../iam/operations/sa/get-id.md), or [user group](../../../organization/operations/group-get-id.md) to view their list of accesses.

  1. Use the `yc iam access-analyzer list-subject-access-bindings` command to get a list of subject’s accesses:

     ```bash
     yc iam access-analyzer list-subject-access-bindings \
        --organization-id=<organization_ID> \
        --subject-id=<subject_ID>
     ```

     Where:

     * `--organization-id`: [Organization ID](../../../organization/operations/organization-get-id.md).
     * `--subject-id`: ID of a [subject](../../../iam/concepts/access-control/index.md#subject), i.e., a [user](../../../overview/roles-and-resources.md#users), [service account](../../../iam/concepts/users/accounts.md#sa), [user group](../../../organization/concepts/groups.md), [system group](../../../iam/concepts/access-control/system-group.md), or [public group](../../../iam/concepts/access-control/public-group.md).

     Result:

     ```text
     +---------+-------------------------+----------------------+----------+
     | ROLE ID |      RESOURCE TYPE      |     RESOURCE ID      | GROUP ID |
     +---------+-------------------------+----------------------+----------+
     | admin   | resource-manager.cloud  | b1g2c5615qja******** |          |
     | admin   | resource-manager.folder | b1gq979gqitb******** |          |
     +---------+-------------------------+----------------------+----------+
     ```
  
     You will get the list of accesses as a table. For each access, the list indicates a role assigned to the subject for a resource as well as the resource type and ID. If the subject has not been assigned any role directly, but has inherited it from a group, the list will indicate the group ID.

{% endlist %}

## Revoking subject’s access {#revoke}

Accesses can be revoked by a user with the `admin`, `resource-manager.admin`, `organization-manager.admin`, `resource-manager.clouds.owner`, or `organization-manager.organizations.owner` role, or with the admin role for the [service](../../../overview/concepts/services.md) to whose resource the subject’s access is being revoked.

To revoke a subject's access (role) for a resource:

1. [Open](#view) the list of the subject's accesses and select the one you want to revoke.

    Use filtering by resource ID, role ID, or access assignment method (`Directly appointed` or `Assigned via group`), if required.

1. Revoke access based on the assignment method used:

    {% list tabs %}

    - Direct assignment

      If access is assigned to the subject directly (the **Group** field is left blank):

      1. In the row with the access you need, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![person-xmark](../../../_assets/console-icons/person-xmark.svg) **Revoke access**.
      1. In the window that opens, verify info on the resource you are revoking access to and select the roles to revoke.
      1. Click **Revoke all** (or **Revoke selected** if you left some roles unselected).

    - Group-based assignment

      If access is assigned to the subject through a group (the **Group** field contains the group name and ID), such access cannot be revoked from the subject. Instead, you can either remove the subject from this user group or revoke the access from the whole group.

      * To remove a subject from a [user group](../../../organization/concepts/groups.md):

          1. In the row with the access, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![person-xmark](../../../_assets/console-icons/person-xmark.svg) **Remove from group**.
          1. In the window that opens, review the list of accesses the subject will lose when removed from the group, and click **Remove**.

          You cannot remove a subject from a [system group](../../../iam/concepts/access-control/system-group.md) or [public group](../../../iam/concepts/access-control/public-group.md). To revoke access granted through one of these groups, you have to revoke that access from the whole group.

      * To revoke access from the whole group, [open](#view) the list of accesses for that group and follow the guide on how to revoke directly assigned access.

    {% endlist %}

#### Useful links {#see-also}

* [Access Analyzer module](../../concepts/access-analyzer.md)
* [Working with recommendations in the Access Analyzer module](use-recommendations.md)

[*organization_definition]: An _organization_ is the highest resource in the Yandex Cloud resource model hierarchy that consolidates the resources of all other services. It is also used for user management as well as authentication and authorization management. For more information, see [Organization](../../../organization/concepts/organization.md).