[Yandex Cloud documentation](../../index.md) > [Yandex WebSQL](../index.md) > Access management # Access management in WebSQL In this section, you will learn about: * [Resources you can assign a role for](#resources). * [Roles this service has](#roles-list). * [Roles required](#required-roles) for specific actions. ## Access management {#about-access-control} [Yandex Identity and Access Management](../../iam/index.md) checks all operations in Yandex Cloud. If an entity does not have required permissions, IAM returns an error. To grant permissions for a resource, [assign](../../iam/operations/roles/grant.md) the relevant resource roles to an entity performing operations. You can assign roles to a [Yandex account](../../iam/concepts/users/accounts.md#passport), [service account](../../iam/concepts/users/service-accounts.md), [local user](../../iam/concepts/users/accounts.md#local), [federated user](../../iam/concepts/federations.md), [user group](../../organization/operations/manage-groups.md), [system group](../../iam/concepts/access-control/system-group.md), or [public group](../../iam/concepts/access-control/public-group.md). For more information, see [How access management works in Yandex Cloud](../../iam/concepts/access-control/index.md). To assign a role for a resource, you need the `websql.admin` role or one of the following roles for that resource: * `admin` * `resource-manager.admin` * `organization-manager.admin` * `resource-manager.clouds.owner` * `organization-manager.organizations.owner` ## Resources you can assign a role for {#resources} You can assign a role to an [organization](../../organization/concepts/organization.md), [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). The roles assigned to organizations, clouds, and folders also apply to their nested resources. You can also assign roles in the [WebSQL interface](https://websql.yandex.cloud) for [saved](../concepts/index.md#saved-queries) and [historical queries](../concepts/index.md#query-log) you published. ## Roles this service has {#roles-list} You can use Yandex WebSQL roles (_service roles_) and Yandex Cloud roles (_primitive roles_) to manage query access permissions. ### Service roles {#service-roles} The list below shows all the roles used for access control in WebSQL. ```mermaid %%{ init: { "flowchart": { "defaultRenderer": "elk" }, "elk": { "nodePlacementStrategy": "BRANDES_KOEPF" } } }%% flowchart BT websql.executedQueries.editor --> websql.editor websql.user --> websql.editor websql.savedQueries.editor --> websql.editor websql.executedQueries.admin --> websql.admin websql.editor --> websql.admin websql.savedQueries.admin --> websql.admin websql.executedQueries.viewer --> websql.viewer websql.viewer --> websql.user websql.executedQueries.auditor --> websql.auditor websql.auditor --> websql.viewer websql.savedQueries.auditor --> websql.auditor websql.savedQueries.viewer --> websql.viewer websql.executedQueries.editor --> websql.executedQueries.admin websql.savedQueries.editor --> websql.savedQueries.admin websql.executedQueries.viewer --> websql.executedQueries.editor websql.savedQueries.viewer --> websql.savedQueries.editor websql.executedQueries.auditor --> websql.executedQueries.viewer websql.savedQueries.auditor --> websql.savedQueries.viewer ``` #### websql.executedQueries.auditor {#websql-executedQueries-auditor} The `websql.executedQueries.auditor` role enables viewing the metadata of a published query from the history as well as information on [access permissions](../../iam/concepts/access-control/index.md) assigned to it. #### websql.savedQueries.auditor {#websql-savedQueries-auditor} The `websql.savedQueries.auditor` role enables viewing the metadata of a published saved query as well as information on [access permissions](../../iam/concepts/access-control/index.md) assigned to it. #### websql.executedQueries.viewer {#websql-executedQueries-viewer} The `websql.executedQueries.viewer` role enables viewing info on a published query from the history and [access permissions](../../iam/concepts/access-control/index.md) assigned to it. This role includes the `websql.executedQueries.auditor` permissions. The role is assigned for a published historical query. #### websql.savedQueries.viewer {#websql-savedQueries-viewer} The `websql.savedQueries.viewer` role enables viewing info on a published saved query and [access permissions](../../iam/concepts/access-control/index.md) assigned to it. This role includes the `websql.savedQueries.auditor` permissions. The role is assigned for a saved query you published. #### websql.executedQueries.editor {#websql-executedQueries-editor} The `websql.executedQueries.editor` role enables viewing info on a published query from the history and delete such a query. Users with this role can: * View info on a published query from the history and delete such a query. * View info on the [access permissions](../../iam/concepts/access-control/index.md) assigned to a published query from the history. This role includes the `websql.executedQueries.viewer` permissions. The role is assigned for a published historical query. #### websql.savedQueries.editor {#websql-savedQueries-editor} The `websql.savedQueries.editor` role enables modifying and deleting a published saved query. Users with this role can: * View info on a published saved query, as well as modify and delete it. * View info on the [access permissions](../../iam/concepts/access-control/index.md) assigned to a published saved query. This role includes the `websql.savedQueries.viewer` permissions. The role is assigned for a saved query you published. #### websql.executedQueries.admin {#websql-executedQueries-admin} The `websql.executedQueries.admin` role enables managing a published query from the history and access to such a query. Users with this role can: * View info on the [access permissions](../../iam/concepts/access-control/index.md) assigned to a published query from the history and modify such permissions. * View info on a published query from the history and delete such a query. This role includes the `websql.executedQueries.editor` permissions. The role is assigned for a published historical query. #### websql.savedQueries.admin {#websql-savedQueries-admin} The `websql.savedQueries.admin` role enables managing a published saved query and access to it. Users with this role can: * View info on the [access permissions](../../iam/concepts/access-control/index.md) assigned to a published saved query and modify such permissions. * View info on a published saved query, as well as modify and delete it. This role includes the `websql.savedQueries.editor` permissions. The role is assigned for a saved query you published. #### websql.auditor {#websql-auditor} The `websql.auditor` role enables viewing the metadata of all published queries within WebSQL as well as information on [access permissions](../../iam/concepts/access-control/index.md) assigned to them. This role includes the `websql.savedQueries.auditor` and `websql.executedQueries.auditor` permissions. #### websql.viewer {#websql-viewer} The `websql.viewer` role enables viewing info on all published queries within WebSQL and access permissions assigned to them. Users with this role can: * View info on the published saved queries and [access permissions](../../iam/concepts/access-control/index.md) assigned to them. * View info on the published queries from the history and access permissions assigned to them. This role includes the `websql.savedQueries.viewer` and `websql.executedQueries.viewer` permissions. #### websql.user {#websql-user} The `websql.user` role enables viewing info on the published queries within WebSQL, as well as create, modify, and delete such queries. Users with this role can: * View info on the published saved queries and [access permissions](../../iam/concepts/access-control/index.md) assigned to them. * Privately save queries and modify and delete privately saved queries. * View info on the published queries from the history and access permissions assigned to them. * Save the run queries to private history and delete them from history. This role includes the `websql.viewer` permissions. #### websql.editor {#websql-editor} The `websql.editor` role enables managing published and private queries within WebSQL. Users with this role can: * View info on the published saved queries and [access permissions](../../iam/concepts/access-control/index.md) assigned to them, as well as modify and delete such queries. * Save queries privately, as well as modify, delete, and publish private saved queries. * View info on the published queries from the history and access permissions assigned to them, as well as modify and delete such queries. * Save the run queries to private history, as well publish private queries from the history and delete them. This role includes the `websql.user`, `websql.savedQueries.editor`, and `websql.executedQueries.editor` permissions. #### websql.admin {#websql-admin} The `websql.admin` role enables managing private queries and publishing them, as well as manage published queries and access to those. Users with this role can: * View info on the [access permissions](../../iam/concepts/access-control/index.md) assigned to the published saved queries and modify such permissions. * View info on the published saved queries, as well as modify and delete them. * Save queries privately, as well as modify, delete, and publish private saved queries. * View info on the access permissions assigned to the published queries from the history and modify such permissions. * View info on the published queries from the history and delete them. * Save the run queries to private history, as well publish private queries from the history and delete them. This role includes the `websql.editor`, `websql.savedQueries.admin`, and `websql.executedQueries.admin` permissions. ### Primitive roles {#primitive-roles} Primitive roles allow users to perform actions in all Yandex Cloud [services](../../overview/concepts/services.md). #### auditor {#auditor} The `auditor` role grants a permission to read configuration and metadata of any Yandex Cloud resources without any access to data. For instance, users with this role can: * View info on a [resource](../../resource-manager/concepts/resources-hierarchy.md). * View the resource metadata. * View the list of operations with a resource. `auditor` is the most secure role that does not grant any access to the [service](../../overview/concepts/services.md) data. This role suits the users who need minimum access to the Yandex Cloud resources. #### viewer {#viewer} The `viewer` role grants the permissions to read the info on any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md). This role includes the `auditor` permissions. Unlike `auditor`, the `viewer` role provides access to [service](../../overview/concepts/services.md) data in read mode. #### editor {#editor} The `editor` role provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md), except for assigning roles to other users, transferring [organization](../../organization/concepts/organization.md) ownership, removing an organization, and deleting Key Management Service [encryption keys](../../kms/concepts/index.md). For instance, users with this role can create, modify, and delete resources. This role includes the `viewer` permissions. #### admin {#admin} The `admin` role enables assigning any roles, except for `resource-manager.clouds.owner` and `organization-manager.organizations.owner`, and provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md) (except for transferring [organization](../../organization/concepts/organization.md) ownership and removing an organization). Prior to assigning the `admin` role for an organization, [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [billing account](../../billing/concepts/billing-account.md), make sure to check out the information on protecting [privileged accounts](../../security/standard/all.md#privileged-users). This role includes the `editor` permissions. Instead of primitive roles, we recommend using service roles with more granular access control, allowing you to implement the [least privilege principle](../../security/standard/all.md#min-privileges). For more information on primitive roles, see the [Yandex Cloud role reference](../../iam/roles-reference.md#primitive-roles). ## Required roles {#required-roles} The table below lists the roles required for specific actions. You can always assign a role with more permissions, e.g., `editor` instead of `viewer`. If you need access to multiple types of managed DB clusters within one folder, you can assign the `mdb.auditor` role for this folder, but bear in mind that the user will thus get excessive [permissions](../../iam/roles-reference.md#mdb-auditor). Action | Required roles ----- | ----- **Viewing queries** | Viewing information on connections | `connection-manager.viewer` for an organization, cloud, folder, or connection Viewing information on PostgreSQL connections | `managed-postgresql.viewer` for an organization, cloud, or folder Viewing information on MySQL® connections | `managed-mysql.viewer` for an organization, cloud, or folder Viewing information on ClickHouse® connections | `managed-clickhouse.viewer` for an organization, cloud, or folder Viewing information on Valkey™ connections | `managed-redis.viewer` for an organization, cloud, or folder Viewing information on Yandex StoreDoc connections | `managed-mongodb.viewer` for an organization, cloud, or folder Viewing information on Greenplum® connections | `managed-greenplum.viewer` for an organization, cloud, or folder Viewing information on [Yandex Managed Service for Trino](../../managed-trino/concepts/index.md) connections (the service is at the [Preview](../../overview/concepts/launch-stages.md) stage): | `managed-trino.viewer` for an organization, cloud, or folder Viewing metadata of published queries | `websql.auditor` for an organization, cloud, or folder Viewing published queries | `websql.viewer` for an organization, cloud, or folder **Viewing and running queries** | Using a database connection | `connection-manager.user` for an organization, cloud, folder, or connection Viewing information on PostgreSQL connections | `managed-postgresql.viewer` for an organization, cloud, or folder Viewing information on MySQL® connections | `managed-mysql.viewer` for an organization, cloud, or folder Viewing information on ClickHouse® connections | `managed-clickhouse.viewer` for an organization, cloud, or folder Viewing information on Valkey™ connections | `managed-redis.viewer` for an organization, cloud, or folder Viewing information on Yandex StoreDoc connections | `managed-mongodb.viewer` for an organization, cloud, or folder Viewing information on Greenplum® connections | `managed-greenplum.viewer` for an organization, cloud, or folder Viewing information on [Yandex Managed Service for Trino](../../managed-trino/concepts/index.md) connections (the service is at the [Preview](../../overview/concepts/launch-stages.md) stage): | `managed-trino.viewer` for an organization, cloud, or folder Running queries | `websql.user` for an organization, cloud, or folder Running [Yandex Managed Service for Trino](../../managed-trino/concepts/index.md) queries (currently at the [Preview](../../overview/concepts/launch-stages.md) stage): | `managed-trino.user` for an organization, cloud, or folder **Viewing, running, and publishing queries** | Using a database connection | `connection-manager.user` for an organization, cloud, folder, or connection Viewing information on PostgreSQL connections | `managed-postgresql.viewer` for an organization, cloud, or folder Viewing information on MySQL® connections | `managed-mysql.viewer` for an organization, cloud, or folder Viewing information on ClickHouse® connections | `managed-clickhouse.viewer` for an organization, cloud, or folder Viewing information on Valkey™ connections | `managed-redis.viewer` for an organization, cloud, or folder Viewing information on Yandex StoreDoc connections | `managed-mongodb.viewer` for an organization, cloud, or folder Viewing information on Greenplum® connections | `managed-greenplum.viewer` for an organization, cloud, or folder Viewing information on [Yandex Managed Service for Trino](../../managed-trino/concepts/index.md) connections (the service is at the [Preview](../../overview/concepts/launch-stages.md) stage): | `managed-trino.viewer` for an organization, cloud, or folder Running, publishing, and editing queries | `websql.editor` for an organization, cloud, or folder Running [Yandex Managed Service for Trino](../../managed-trino/concepts/index.md) queries (currently at the [Preview](../../overview/concepts/launch-stages.md) stage): | `managed-trino.user` for an organization, cloud, or folder **Managing queries** | Using a database connection | `connection-manager.user` for an organization, cloud, folder, or connection Viewing information on PostgreSQL connections | `managed-postgresql.viewer` for an organization, cloud, or folder Viewing information on MySQL® connections | `managed-mysql.viewer` for an organization, cloud, or folder Viewing information on ClickHouse® connections | `managed-clickhouse.viewer` for an organization, cloud, or folder Viewing information on Valkey™ connections | `managed-redis.viewer` for an organization, cloud, or folder Viewing information on Yandex StoreDoc connections | `managed-mongodb.viewer` for an organization, cloud, or folder Viewing information on Greenplum® connections | `managed-greenplum.viewer` for an organization, cloud, or folder Viewing information on [Yandex Managed Service for Trino](../../managed-trino/concepts/index.md) connections (the service is at the [Preview](../../overview/concepts/launch-stages.md) stage): | `managed-trino.viewer` for an organization, cloud, or folder Running, publishing, and editing queries and managing access permissions to them | `websql.admin` for an organization, cloud, or folder Running [Yandex Managed Service for Trino](../../managed-trino/concepts/index.md) queries (currently at the [Preview](../../overview/concepts/launch-stages.md) stage): | `managed-trino.user` for an organization, cloud, or folder ## What's next {#whats-next} * [How to assign a role](../../iam/operations/roles/grant.md). * [How to revoke a role](../../iam/operations/roles/revoke.md). * [Learn more about access management in Yandex Cloud](../../iam/concepts/access-control/index.md). * [Learn more about role inheritance](../../resource-manager/concepts/resources-hierarchy.md#access-rights-inheritance).