[Yandex Cloud documentation](../index.md) > Security in Yandex Cloud > Security in Yandex Cloud # Security in Yandex Cloud This section offers recommendations on how to build a secure Yandex Cloud infrastructure, practical guidelines, and security bulletins. # Security in Yandex Cloud - [Key security features](principles.md) - [Division of responsibility for security](respons.md) - [Compliance](conform.md) - [Security measures on the Yandex Cloud side](standarts.md) - [Security tools available to cloud service users](user-side.md) ## Best practices for securing your cloud infrastructure - [All recommendations](domains/index.md) - [IaaS security checklist](domains/iaas-checklist.md) - [Authentication and authorization security checklist](domains/iam-checklist.md) - [Ransomware attack prevention checklist](domains/ransomware-checklist.md) - [Kubernetes security](domains/kubernetes.md) - [Reference architecture for cloud infrastructure in isolated mode without internet access](domains/architecture-isolated.md) ## Cloud infrastructure security standard, version 1.4.2 - [All sections on one page](standard/all.md) - [Introduction](standard/index.md) - [Authentication and access management](standard/authentication.md) - [Network security](standard/network-security.md) - [Secure virtual environment configuration](standard/virtualenv-safe-config.md) - [Data encryption and key management](standard/encryption.md) - [Collecting, monitoring, and analyzing audit logs](standard/audit-logs.md) - [Application protection](standard/app-security.md) - [Security Kubernetes](standard/kubernetes-security.md) - [Versions](standard/versions.md) ## Yandex 360 protection and safe use standard, version 1.0.0 - [All sections on one page](standard-360/all.md) - [Introduction](standard-360/index.md) - [Authentication and access management](standard-360/authentication.md) - [Session and cookie security](standard-360/session-security.md) - [Monitoring and audit](standard-360/monitoring.md) - [Data encryption and protection](standard-360/encryption-data-protection.md) - [Integrations and third-party solutions](standard-360/integrations.md) ## Tutorials - [All tutorials](tutorials/index.md) ### Authentication and access management - [Access control for user groups with different roles in Yandex Identity Hub](tutorials/authentication/user-group-access-control.md) - [Using a service account with an OS Login profile for VM management via Ansible](tutorials/authentication/sa-oslogin-ansible.md) - [Authentication via Active Directory](tutorials/authentication/integration-adfs.md) - [Google Workspace authentication](tutorials/authentication/integration-gworkspace.md) - [Authentication using Microsoft Entra ID](tutorials/authentication/integration-azure.md) - [Keycloak authentication](tutorials/authentication/integration-keycloak.md) - [User group mapping in Active Directory Federation Services](tutorials/authentication/adfs.md) - [User group mapping in Microsoft Entra ID](tutorials/authentication/entra-id.md) - [User group mapping in Keycloak](tutorials/authentication/keycloak.md) ### SSO setup - [Setting up OIDC SSO in 1C:Enterprise](tutorials/single-sign-on/oidc-1c-enterprise.md) #### Cloud.ru - [Setting up SAML SSO in Cloud.ru](tutorials/single-sign-on/saml-cloud-ru.md) - [Setting up OIDC SSO in Cloud.ru](tutorials/single-sign-on/oidc-cloud-ru.md) #### Grafana - [Setting up SAML SSO in Grafana Cloud](tutorials/single-sign-on/saml-grafana.md) - [Setting up OIDC SSO in Grafana Cloud](tutorials/single-sign-on/oidc-grafana.md) - [Setting up OIDC SSO in Grafana OSS](tutorials/single-sign-on/oidc-grafana-oss.md) - [Setting up OIDC SSO in Harbor](tutorials/single-sign-on/oidc-harbor.md) #### Jenkins - [Setting up SAML SSO in Jenkins](tutorials/single-sign-on/saml-jenkins.md) - [Setting up OIDC SSO in Jenkins](tutorials/single-sign-on/oidc-jenkins.md) - [Setting up SAML SSO in Managed Service for GitLab](tutorials/single-sign-on/saml-managed-gitlab.md) - [Setting up SAML SSO in Managed Service for OpenSearch](tutorials/single-sign-on/saml-opensearch.md) - [Setting up OIDC SSO in MWS](tutorials/single-sign-on/oidc-mws.md) - [Setting up OIDC SSO using NetBird](tutorials/single-sign-on/oidc-netbird.md) - [Setting up SAML SSO in OpenSearch](tutorials/single-sign-on/saml-opensearch-self-managed.md) #### OpenVPN - [Setting up SAML SSO in OpenVPN Access Server](tutorials/single-sign-on/saml-ovpn.md) - [Setting up OIDC SSO in OpenVPN Community Edition](tutorials/single-sign-on/oidc-ovpn.md) - [Setting up SAML SSO in Selectel](tutorials/single-sign-on/saml-selectel.md) - [Setting up SAML SSO in Sentry](tutorials/single-sign-on/saml-sentry.md) - [Setting up SAML SSO in SonarQube](tutorials/single-sign-on/saml-sonarqube.md) #### VK Cloud - [Setting up SAML SSO in VK Cloud](tutorials/single-sign-on/saml-vk-cloud.md) - [Setting up SAML SSO in Zabbix](tutorials/single-sign-on/saml-zabbix.md) - [Setting up SAML SSO in Passwork](tutorials/single-sign-on/saml-passwork.md) - [Setting up SAML SSO in Yandex 360](tutorials/single-sign-on/saml-yandex-360.md) - [Yandex Browser for organizations](tutorials/single-sign-on/saml-ya-browser-corporate.md) - [Using OAuth2 Proxy for applications not supporting SSO](tutorials/single-sign-on/oidc-nginx-oauth2-proxy.md) ### Network security - [Setting up virtual hosting](tutorials/network-security/virtual-hosting.md) - [Automatically copying objects from one Object Storage bucket to another](tutorials/network-security/bucket-to-bucket-copying.md) - [Loading data from Yandex Direct to a Managed Service for ClickHouse® data mart using Cloud Functions, Object Storage, and Data Transfer](tutorials/network-security/data-transfer-direct-to-mch.md) #### Creating a load balancer with DDoS protection - [Overview](tutorials/network-security/alb-with-ddos-protection/index.md) - [Creating an L7 load balancer with DDoS protection using the management console or CLI](tutorials/network-security/alb-with-ddos-protection/console.md) - [Creating an L7 load balancer with DDoS protection using Terraform](tutorials/network-security/alb-with-ddos-protection/terraform.md) - [Secure user access to cloud resources based on WireGuard VPN](tutorials/network-security/remote-wireguard-vpn.md) - [ViPNet Coordinator VA in Yandex Cloud](tutorials/network-security/vipnet-to-yc.md) #### Providing secure access to content in Cloud CDN - [Overview](tutorials/network-security/protected-access-to-content/index.md) - [Providing secure access to content in Cloud CDN using the management console, CLI, or API](tutorials/network-security/protected-access-to-content/console.md) - [Providing secure access to content in Cloud CDN through Terraform](tutorials/network-security/protected-access-to-content/terraform.md) ### Secure virtual environment configuration - [Hosting a static Gatsby website in Object Storage](tutorials/virtualenv-safe-config/gatsby-static-website.md) - [Storing Apache Airflow™ connections and variables in Yandex Lockbox](tutorials/virtualenv-safe-config/lockbox-and-airflow.md) - [Deploying a fault-tolerant architecture with preemptible VMs](tutorials/virtualenv-safe-config/nodejs-cron-restart-vm.md) - [Migrating services from an NLB with VMs as targets to an L7 ALB](tutorials/virtualenv-safe-config/nlb-with-target-resource-vm.md) - [Migrating services from an NLB with an instance group as a target to an L7 ALB](tutorials/virtualenv-safe-config/nlb-with-target-resource-group-vm.md) - [Migrating services from an external NLB to L7 ALB with an internal NLB as a target](tutorials/virtualenv-safe-config/nlb-as-target-resource-alb.md) ### Data encryption and key management - [Which encryption method should I choose?](tutorials/data-encryption-and-key-management/choose-encryption-method.md) - [Encrypting data using the Yandex Cloud CLI and API](tutorials/data-encryption-and-key-management/cli-api.md) - [Encrypting data using the Yandex Cloud SDK](tutorials/data-encryption-and-key-management/sdk.md) - [Encrypting data using the AWS Encryption SDK](tutorials/data-encryption-and-key-management/aws-encryption-sdk.md) - [Encrypting data using Google Tink](tutorials/data-encryption-and-key-management/google-tink.md) - [Managing Key Management Service keys with Terraform](tutorials/data-encryption-and-key-management/terraform-key.md) - [Encrypting secrets in Terraform](tutorials/data-encryption-and-key-management/terraform-secret.md) - [Auto Unseal in Hashicorp Vault](tutorials/data-encryption-and-key-management/vault-secret.md) #### Secure password transmission to an initialization script - [Overview](tutorials/data-encryption-and-key-management/secure-password-script/index.md) - [Management console, CLI, and API](tutorials/data-encryption-and-key-management/secure-password-script/console.md) - [Terraform](tutorials/data-encryption-and-key-management/secure-password-script/terraform.md) #### Terminating TLS connections - [Overview](tutorials/data-encryption-and-key-management/tls-termination/index.md) - [Terminating TLS connections using the management console](tutorials/data-encryption-and-key-management/tls-termination/console.md) - [Terminating TLS connections using Terraform](tutorials/data-encryption-and-key-management/tls-termination/terraform.md) - [Secure storage of GitLab CI passwords as Yandex Lockbox secrets](tutorials/data-encryption-and-key-management/gitlab-lockbox-integration.md) #### Using a Yandex Lockbox secret to store a static access key - [Overview](tutorials/data-encryption-and-key-management/static-key-in-lockbox/index.md) - [Using a Yandex Lockbox secret to store a static access key via the CLI](tutorials/data-encryption-and-key-management/static-key-in-lockbox/console.md) - [Using a Yandex Lockbox secret to store a static access key with Terraform](tutorials/data-encryption-and-key-management/static-key-in-lockbox/terraform.md) - [Getting Yandex Lockbox secret value on the GitHub side](tutorials/data-encryption-and-key-management/wlif-github-integration.md) - [Getting Yandex Lockbox secret value on the GitLab side](tutorials/data-encryption-and-key-management/wlif-gitlab-integration.md) - [Uploading objects into an Object Storage bucket with an ephemeral access key](tutorials/data-encryption-and-key-management/ephemeral-key-storage.md) ### Collecting, monitoring, and analyzing audit logs - [Searching for Yandex Cloud events in Query](tutorials/audit-logs/query.md) - [Searching for Yandex Cloud events in Object Storage](tutorials/audit-logs/search-bucket.md) - [Searching for Yandex Cloud events in Cloud Logging](tutorials/audit-logs/search-cloud-logging.md) - [Configuring alerts and dashboards in Monitoring](tutorials/audit-logs/alerts-monitoring.md) - [Configuring responses in Cloud Logging and Cloud Functions](tutorials/audit-logs/logging-functions.md) - [Processing Audit Trails events](tutorials/audit-logs/audit-trails.md) - [Uploading audit logs to Managed Service for Elasticsearch](tutorials/audit-logs/trails-logs-opensearch.md) #### Exporting audit logs to MaxPatrol SIEM - [Overview](tutorials/audit-logs/maxpatrol/index.md) - [Management console](tutorials/audit-logs/maxpatrol/console.md) - [Terraform](tutorials/audit-logs/maxpatrol/terraform.md) - [Uploading audit logs to Splunk SIEM](tutorials/audit-logs/export-logs-to-splunk.md) - [Uploading audit logs to ArcSight SIEM](tutorials/audit-logs/export-logs-to-arcsight.md) #### Uploading Audit Trails events to KUMA SIEM - [Overview](tutorials/audit-logs/audit-trails-events-to-kuma/index.md) - [Uploading audit logs to KUMA SIEM using the management console, CLI, or API](tutorials/audit-logs/audit-trails-events-to-kuma/console.md) - [Uploading audit logs to KUMA SIEM through Terraform](tutorials/audit-logs/audit-trails-events-to-kuma/terraform.md) - [Transferring logs from a VM to Cloud Logging](tutorials/audit-logs/vm-fluent-bit-logging.md) - [Writing load balancer logs to PostgreSQL](tutorials/audit-logs/logging.md) - [Transferring logs from Container Optimized Image to Cloud Logging](tutorials/audit-logs/coi-fluent-bit-logging.md) ### Application protection - [Building a CI/CD pipeline in GitLab using serverless products](tutorials/app-security/ci-cd-serverless.md) - [Creating an interactive serverless application using WebSocket](tutorials/app-security/websocket-app.md) #### Creating an L7 load balancer in Application Load Balancer with a Smart Web Security profile - [Overview](tutorials/app-security/balancer-with-sws-profile/index.md) - [Management console](tutorials/app-security/balancer-with-sws-profile/console.md) - [Terraform](tutorials/app-security/balancer-with-sws-profile/terraform.md) - [API Gateway protection with Smart Web Security](tutorials/app-security/api-gw-sws-integration.md) - [Managing traffic sources](tutorials/app-security/traffic-sources-management.md) - [Adding an HTML page for SmartCaptcha](tutorials/app-security/website.md) - [SmartCaptcha on Android](tutorials/app-security/quickstart-android.md) - [Invisible SmartCaptcha on Android](tutorials/app-security/invisible-captcha-android.md) - [SmartCaptcha in Flutter Android apps](tutorials/app-security/quickstart-android-flutter.md) - [SmartCaptcha on iOS](tutorials/app-security/quickstart-ios.md) ### Kubernetes security - [Encrypting secrets in Managed Service for Kubernetes](tutorials/kubernetes-security/kms-k8s.md) - [Signing and verifying Container Registry Docker images in Managed Service for Kubernetes](tutorials/kubernetes-security/sign-cr-with-cosign.md) - [Syncing with Managed Service for Kubernetes secrets](tutorials/kubernetes-security/kubernetes-lockbox-secrets.md) - [Getting the Yandex Lockbox secret value on the custom Kubernetes installation side](tutorials/kubernetes-security/wlif-k8s-integration.md) - [Accessing the Yandex Cloud API from a Managed Service for Kubernetes cluster using a workload identity federation](tutorials/kubernetes-security/wlif-managed-k8s-integration.md) - [Creating an L7 load balancer with a Smart Web Security profile through an Application Load Balancer ingress controller](tutorials/kubernetes-security/alb-ingress-with-sws-profile.md) #### Migrating services from an NLB with a Managed Service for Kubernetes cluster as a target to an L7 ALB - [Overview](tutorials/kubernetes-security/nlb-with-target-resource-k8s/index.md) - [Management console](tutorials/kubernetes-security/nlb-with-target-resource-k8s/console.md) - [Terraform](tutorials/kubernetes-security/nlb-with-target-resource-k8s/terraform.md) - [Transferring a Managed Service for Kubernetes cluster's logs to Cloud Logging](tutorials/kubernetes-security/k8s-fluent-bit-logging.md) - [Obtaining the information you need to request the Russian Ministry of Digital Development to whitelist a resource](tutorials/info-for-federal-ip-whitelist.md) ## Guides - [Deleting a Yandex account from Yandex Identity Hub](operations/account-deletion.md) - [If you are being attacked from Yandex Cloud addresses](operations/outgoing-ddos.md) - [Scanning for Yandex Cloud secrets in public sources](operations/search-secrets.md) - [User support policy during vulnerability scanning](compliance/pentest.md) - [Security bulletins](security-bulletins/index.md) - [Public IP address ranges](ip-list.md)