[Yandex Cloud documentation](../../../index.md) > [Yandex Security Deck](../../index.md) > [Step-by-step guides](../index.md) > [Access Analyzer](index.md) > Working with recommendations

# Working with recommendations in the Access Analyzer module

{% note info %}

This feature, recommendations, is at the [Preview](../../../overview/concepts/launch-stages.md) stage. To get access, contact [support](https://center.yandex.cloud/support) or your account manager.

{% endnote %}

The [Access Analyzer module](https://center.yandex.cloud/security/access-analyzer/) identifies unused and excessively granted privileges and provides [recommendations](../../concepts/access-analyzer.md#recommendations) for replacing or revoking excessive roles. If any recommendations do not suit you, you can hide them.

Recommendations can be accepted by users holding one of the following roles: `admin`, `resource-manager.admin`, `organization-manager.admin`, `resource-manager.clouds.owner`, `organization-manager.organizations.owner`.

To use the recommendation functionality, [enable](../workspaces/update.md) the Access Analyzer module in the [workspace](../../concepts/workspace.md) settings.

{% note alert %}

Any recommendations regarding the revocation or modification of role compositions provided by the Access Analyzer module are general in nature and may ignore the specifics of your products and infrastructure.

Independently analyze any recommendations provided by the module. By accepting a recommendation, you assume the risk of potential consequences that may arise from implementing the proposed changes.

{% endnote %}

## View recommendations {#view}

To view recommendations in the [Security Deck UI](https://center.yandex.cloud/security/access-analyzer/), users must have the `security-deck.viewer` [role](../../security/index.md#security-deck-viewer) or higher for the [workspace](../../concepts/workspace.md).

To view Access Analyzer recommendations:

{% list tabs group=instructions %}

- Security Deck UI {#cloud-sd}

  1. Log in to [Yandex Security Deck](https://center.yandex.cloud/security/).
  1. Ensure that the Access Analyzer module is enabled in your [workspace](../../concepts/workspace.md).
  1. On the left panel, select ![person-gear](../../../_assets/console-icons/person-gear.svg) **Access Analyzer**, and at the top of the screen, select the workspace.
  1. Navigate to the **Recommendations** tab.

{% endlist %}

This will open a page with a list of Access Analyzer recommendations. At the top of the screen, there is a filter bar that allows you to select recommendations based on [type](../../concepts/access-analyzer.md#recommendation-types), [subjects](../../../iam/concepts/access-control/index.md#subject) being checked, monitored resources and roles, as well as the specified [visibility](#manage-visibility).

The date and time of the last analysis are displayed below the filter bar.

The list of recommendations contains the following fields:

* **Subject**: Name and type of the subject to which the recommendation was issued.

    A subject can be a user, [service account](../../../iam/concepts/users/service-accounts.md), [user group](../../../organization/concepts/groups.md), as well as [system](../../../iam/concepts/access-control/system-group.md) or [public](../../../iam/concepts/access-control/public-group.md) group.
* **Resource**: Name and type of the resource for which the access recommendation has been issued.

    A resource can be a [folder](*folder_definition), [cloud](*cloud_definition), or [organization](*organization_definition). Access Analyzer does not provide recommendations regarding roles assigned to subjects for specific Yandex Cloud service resources, such as virtual machines, service accounts, managed database clusters, etc.
* **Current role**: Role assigned to a subject for a resource, and regarding which Access Analyzer has issued a recommendation.
* **Recommendation**: Recommended action: [replace](#replace) or [revoke](#revoke) the current role.

    If it is recommended to replace the role, this field also displays a list (of up to five) of new roles that will be assigned to the subject as a result of the replacement.

### Managing recommendation visibility {#manage-visibility}

You can manage the visibility of recommendations to hide those that do not suit you from the list.

#### Hiding a recommendation {#hide}

{% list tabs group=instructions %}

- Security Deck UI {#cloud-sd}

  1. [Open](#view) the list of Access Analyzer recommendations.
  1. Make sure **Access via OS Login using SSH certificates (recommended)** is selected in the filter bar.
  1. In the row containing the recommendation you want to hide, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![eye-slash](../../../_assets/console-icons/eye-slash.svg) **Hide recommendation**.

      As a result, the recommendation will be hidden from the list of active recommendations and will appear in the list of hidden recommendations.

{% endlist %}

#### Restoring a recommendation {#restore}

{% list tabs group=instructions %}

- Security Deck UI {#cloud-sd}

  1. [Open](#view) the list of Access Analyzer recommendations.
  1. In the filter bar at the top of the screen, select `Hidden`.
  1. In the row containing the recommendation you want to return to the active list, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![arrow-uturn-cw-right](../../../_assets/console-icons/arrow-uturn-cw-right.svg) **Restore to active**.

      As a result, the recommendation will be removed from the list of hidden recommendations and will reappear in the list of active recommendations.

{% endlist %}

## Replacing a role {#replace}

To accept the recommendation to replace a role:

{% list tabs group=instructions %}

- Security Deck UI {#cloud-sd}

  1. [Open](#view) the list of Access Analyzer recommendations.
  1. In the row containing the recommendation to replace the role you want to accept, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![arrows-rotate-right](../../../_assets/console-icons/arrows-rotate-right.svg) **Replace role**.

      In the window that opens, review the details of the proposed replacement and, if you agree, click **Save**.

{% endlist %}

As a result, the initial role assigned to the subject for the resource will be replaced by a new role or set of roles for that same resource.

## Revoking a role {#revoke}

To accept the recommendation to revoke a role:

{% list tabs group=instructions %}

- Security Deck UI {#cloud-sd}

  1. [Open](#view) the list of Access Analyzer recommendations.
  1. In the row containing the recommendation to revoke the role you want to accept, click ![ellipsis](../../../_assets/console-icons/ellipsis.svg) and select ![circle-xmark](../../../_assets/console-icons/circle-xmark.svg) **Revoke role**.

      In the window that opens, review the details of the proposed action and, if you agree, click **Revoke**.

{% endlist %}

As a result, the role assigned to the subject for the resource will be revoked.

#### Useful links {#see-also}

* [Access Analyzer module](../../concepts/access-analyzer.md)
* [Access diagnostics in Access Analyzer](analyze-permissions.md)

[*folder_definition]: A folder is a logical space where you create and group your Yandex Cloud resources. Just like folders in your file system, Yandex Cloud folders make resource management simpler. For more information, see [Folder](../../../resource-manager/concepts/resources-hierarchy.md#folder).

[*cloud_definition]: A cloud is an isolated logical space where folders and other Yandex Cloud resources are created. You cannot move resources from one cloud to another. For more information, see [Cloud](../../../resource-manager/concepts/resources-hierarchy.md#cloud).

[*organization_definition]: An _organization_ is the highest resource in the Yandex Cloud resource model hierarchy that consolidates the resources of all other services. It is also used for user management as well as authentication and authorization management. For more information, see [Organization](../../../organization/concepts/organization.md).