[Yandex Cloud documentation](../../../../index.md) > [Yandex Serverless Integrations](../../../index.md) > [Step-by-step guides](../../index.md) > EventRouter > Managing resource access permissions > Assigning roles for a resource

# Assigning roles for an EventRouter resource

{% list tabs group=instructions %}

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  To assign a role for an EventRouter resource, run the following command:

  * To a user:

      ```bash
      yc serverless <resource_type> add-access-binding <resource_name_or_ID> \
        --user-account-id <user_ID> \
        --role <role>
      ```

  * To a [service account](../../../../iam/concepts/users/service-accounts.md):

      ```bash
      yc serverless <resource_type> add-access-binding <resource_name_or_ID> \
        --service-account-id <service_account_ID> \
        --role <role>
      ```

  * To all authenticated users (the `All authenticated users` [public group](../../../../iam/concepts/access-control/public-group.md)):

      ```bash
      yc serverless <resource_type> add-access-binding <resource_name_or_ID> \
        --all-authenticated-users \
        --role <role>
      ```

  **Example**

  Assigning a role to a service account for a [bus](../../../concepts/eventrouter/bus.md):

  ```bash
  yc serverless eventrouter bus add-access-binding epdplu8jn7sr******** \
    --service-account-id rrbilgiqaptv******** \
    --role serverless.eventrouter.auditor
  ```

  Result:

  ```text
  ...1s...done (3s)
  ```

- API {#api}

  Use the `setAccessBinding` REST API method for the appropriate resource or this gRPC API call: `<service>/SetAccessBinding`.

  For example, when assigning roles for a [bus](../../../concepts/eventrouter/bus.md), use the [setAccessBinding](../../../eventrouter/api-ref/Bus/setAccessBindings.md) REST API method for the [Bus](../../../eventrouter/api-ref/Bus/index.md) resource or the [BusService/SetAccessBinding](../../../eventrouter/api-ref/grpc/Bus/setAccessBindings.md) gRPC API call.

{% endlist %}