[Yandex Cloud documentation](../../index.md) > [Yandex Smart Web Security](../index.md) > Access management # Access management in Smart Web Security In this section, you will learn: * [What resources you can assign a role for](#resources). * [What roles exist in this service](#roles). ## Access management {#about-access-control} [Yandex Identity and Access Management](../../iam/index.md) checks all operations in Yandex Cloud. If an entity does not have required permissions, IAM returns an error. To grant permissions for a resource, [assign](../../iam/operations/roles/grant.md) the relevant resource roles to an entity performing operations. You can assign roles to a [Yandex account](../../iam/concepts/users/accounts.md#passport), [service account](../../iam/concepts/users/service-accounts.md), [local user](../../iam/concepts/users/accounts.md#local), [federated user](../../iam/concepts/federations.md), [user group](../../organization/operations/manage-groups.md), [system group](../../iam/concepts/access-control/system-group.md), or [public group](../../iam/concepts/access-control/public-group.md). For more information, see [How access management works in Yandex Cloud](../../iam/concepts/access-control/index.md). To assign a role for a resource, a user should have the `smart-web-security.admin` role or one of the following roles for that resource: * `admin` * `resource-manager.admin` * `organization-manager.admin` * `resource-manager.clouds.owner` * `organization-manager.organizations.owner` ## Resources you can assign a role for {#resources} You can assign a role for an [organization](../../organization/index.md), [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). Roles assigned for an organization, cloud, or folder also apply to security profiles in them. ## What roles exist in this service {#roles-list} The chart below shows service’s roles and their permission inheritance. For example, `editor` inherits all `viewer` permissions. You can find role descriptions below the chart. ![service-roles-hierarchy](../../_assets/smartwebsecurity/service-roles-hierarchy.svg) ### Service roles {#service-roles} #### smart-web-security.auditor {#smart-web-security-auditor} The `smart-web-security.auditor` role enables viewing info on Smart Web Security resources, as well as on the relevant cloud and folder. Users with this role can: * View info on [security profiles](../concepts/profiles.md). * View the list of [resources](../operations/host-connect.md) to which a security profile is connected. * View info on [WAF profiles](../concepts/waf.md). * View info on [ARL profiles](../concepts/arl.md). * View info on [proxy servers](../concepts/domain-protect.md#proxy). * View info on [lists](../concepts/lists.md). * View info on [response page templates](../concepts/response-templates.md). * View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud). * View info on the relevant [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). To assign the `smart-web-security.auditor` role, you need the `admin` role for the cloud or `smart-web-security.admin` for the folder. #### smart-web-security.viewer {#smart-web-security-viewer} The `smart-web-security.viewer` role enables viewing info on Smart Web Security resources, as well as on the relevant cloud and folder. Users with this role can: * View info on [security profiles](../concepts/profiles.md). * View the list of [resources](../operations/host-connect.md) to which a security profile is connected. * View info on [WAF profiles](../concepts/waf.md). * View info on [ARL profiles](../concepts/arl.md). * View info on [proxy servers](../concepts/domain-protect.md#proxy). * View info on [lists](../concepts/lists.md). * View info on [response page templates](../concepts/response-templates.md). * View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud). * View info on the relevant [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). This role includes the `smart-web-security.auditor` permissions. To assign the `smart-web-security.viewer` role, you need the `admin` role for the cloud or `smart-web-security.admin` for the folder. #### smart-web-security.user {#smart-web-security-user} The `smart-web-security.user` role enables viewing info on Smart Web Security resources, as well as connecting such security profiles to protected resources. Users with this role can: * View info on [security profiles](../concepts/profiles.md) in Smart Web Security and connect them to protected resources. * View the list of [resources](../operations/host-connect.md) to which a security profile is connected. * View info on [WAF profiles](../concepts/waf.md). * View info on [ARL profiles](../concepts/arl.md). * View info on [proxy servers](../concepts/domain-protect.md#proxy). * View info on [lists](../concepts/lists.md). * View info on [response page templates](../concepts/response-templates.md). * View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud). * View info on the relevant [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). This role includes the `smart-web-security.viewer` permissions. To assign the `smart-web-security.user` role, you need the `admin` role for the cloud or `smart-web-security.admin` for the folder. #### smart-web-security.editor {#smart-web-security-editor} The `smart-web-security.editor` role enables using Smart Web Security resources and managing them. Users with this role can: * View info on [security profiles](../concepts/profiles.md) in Smart Web Security, create, modify, and delete them, as well as connect such security profiles to protected resources. * View the list of [resources](../operations/host-connect.md) to which a security profile is connected. * View info on [WAF profiles](../concepts/waf.md), as well as create, modify, use, and delete them. * View info on [ARL profiles](../concepts/arl.md), as well as create, modify, use, and delete them. * View info on [proxy servers](../concepts/domain-protect.md#proxy), as well as create, modify, and delete them. * View info on [lists](../concepts/lists.md), as well as create, modify, use, and delete them. * View info on [response page templates](../concepts/response-templates.md), as well as create, modify, use, and delete them. * View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud). * View info on the relevant [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). This role includes the `smart-web-security.user` permissions. To enable or disable [logging](../concepts/logging.md) in a security profile, you also need the `logging.writer` role or higher for the [log group](../../logging/concepts/log-group.md) to which logs are transferred. To assign the `smart-web-security.editor` role, you need the `admin` role for the cloud or `smart-web-security.admin` for the folder. #### smart-web-security.admin {#smart-web-security-admin} The `smart-web-security.admin` role enables using Smart Web Security resources and managing them. Users with this role can: * View info on [security profiles](../concepts/profiles.md) in Smart Web Security, create, modify, and delete them, as well as connect such security profiles to protected resources. * View the list of [resources](../operations/host-connect.md) to which a security profile is connected. * View info on [WAF profiles](../concepts/waf.md), as well as create, modify, use, and delete them. * View info on [ARL profiles](../concepts/arl.md), as well as create, modify, use, and delete them. * View info on [proxy servers](../concepts/domain-protect.md#proxy), as well as create, modify, and delete them. * View info on [lists](../concepts/lists.md), as well as create, modify, use, and delete them. * View info on [response page templates](../concepts/response-templates.md), as well as create, modify, use, and delete them. * View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud). * View info on the relevant [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). This role includes the `smart-web-security.editor` permissions. To enable or disable [logging](../concepts/logging.md) in a security profile, you also need the `logging.writer` role or higher for the [log group](../../logging/concepts/log-group.md) to which logs are transferred. To assign the `smart-web-security.admin` role, you need the `admin` role for the cloud. ### Primitive roles {#primitive-roles} Primitive roles allow users to perform actions in all Yandex Cloud [services](../../overview/concepts/services.md). #### auditor {#auditor} The `auditor` role grants a permission to read configuration and metadata of any Yandex Cloud resources without any access to data. For instance, users with this role can: * View info on a [resource](../../resource-manager/concepts/resources-hierarchy.md). * View the resource metadata. * View the list of operations with a resource. `auditor` is the most secure role that does not grant any access to the [service](../../overview/concepts/services.md) data. This role suits the users who need minimum access to the Yandex Cloud resources. #### viewer {#viewer} The `viewer` role grants the permissions to read the info on any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md). This role includes the `auditor` permissions. Unlike `auditor`, the `viewer` role provides access to [service](../../overview/concepts/services.md) data in read mode. #### editor {#editor} The `editor` role provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md), except for assigning roles to other users, transferring [organization](../../organization/concepts/organization.md) ownership, removing an organization, and deleting Key Management Service [encryption keys](../../kms/concepts/index.md). For instance, users with this role can create, modify, and delete resources. This role includes the `viewer` permissions. #### admin {#admin} The `admin` role enables assigning any roles, except for `resource-manager.clouds.owner` and `organization-manager.organizations.owner`, and provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md) (except for transferring [organization](../../organization/concepts/organization.md) ownership and removing an organization). Prior to assigning the `admin` role for an organization, [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [billing account](../../billing/concepts/billing-account.md), make sure to check out the information on protecting [privileged accounts](../../security/standard/all.md#privileged-users). This role includes the `editor` permissions. Instead of primitive roles, we recommend using service roles with more granular access control, allowing you to implement the [least privilege principle](../../security/standard/all.md#min-privileges). For more information on primitive roles, see the [Yandex Cloud role reference](../../iam/roles-reference.md#primitive-roles).