[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for YDB](../index.md) > Access management

# Access management in Managed Service for YDB

Yandex Cloud users can only perform operations on resources within the permissions of the [roles](../../iam/concepts/access-control/roles.md) assigned to them. With no roles assigned, almost no operations are allowed.

To allow access to YDB resources (databases and their users), assign the relevant roles from the list below to a Yandex account, [service account](../../iam/concepts/users/service-accounts.md), [federated](../../iam/concepts/users/accounts.md#saml-federation) or [local](../../iam/concepts/users/accounts.md#local) users, [user group](../../organization/operations/manage-groups.md), [system group](../../iam/concepts/access-control/system-group.md), or [public group](../../iam/concepts/access-control/public-group.md). You can assign a role for a parent resource (folder or cloud) whose roles are inherited by nested resources.

For more information about role inheritance, see [Inheriting access permissions](../../resource-manager/concepts/resources-hierarchy.md#access-rights-inheritance) for Yandex Resource Manager.

You can also grant a role to access a specific database. This will allow a user without any roles in the folder hosting the database to access the database according to the role assigned.

To assign a role for a resource, you need the `ydb.admin` role or one of the following roles for that resource:

* `admin`
* `resource-manager.admin`
* `organization-manager.admin`
* `resource-manager.clouds.owner`
* `organization-manager.organizations.owner`

## Assigning roles {#grant-roles}

To assign a role to a user:

1. [Add](../../organization/operations/add-account.md) the appropriate user, if required.
1. In the [management console](https://console.yandex.cloud), on the left, [select](../../resource-manager/operations/cloud/switch-cloud.md) a cloud.
1. Navigate to the **Access bindings** tab.
1. Click **Configure access**.
1. In the window that opens, select **User accounts**.
1. Select a user from the list or use the user search option.
1. Click ![image](../../_assets/console-icons/plus.svg) **Add role** and select a role for the cloud.
1. Click **Save**.

## Resources you can assign a role for {#resources}

You can assign a role to an [organization](../../organization/concepts/organization.md), [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [folder](../../resource-manager/concepts/resources-hierarchy.md#folder). The roles assigned to organizations, clouds, and folders also apply to their nested resources.

You can also assign roles for individual resources within the service:

{% list tabs group=instructions %}

- Management console {#console}

  You can use the [management console](https://console.yandex.cloud) to assign roles for a YDB database.

- CLI {#cli}

  You can use the [Yandex Cloud CLI](../../cli/cli-ref/ydb/cli-ref/index.md) to assign roles for the following resources:

  * YDB database.
  * YDB database backup.

- Terraform {#tf}

  You can use [Terraform](../../terraform/resources/ydb_database_iam_binding.md) to assign roles for a YDB database.

- API {#api}

  You can use the [Yandex Cloud](../api-ref/authentication.md) API to assign roles for the following resources:

  * YDB database.
  * YDB database backup.

{% endlist %}

## Roles this service has {#roles-list}

The list below shows all the roles used for access control in Managed Service for YDB.

```mermaid
%%{init: {"flowchart": {'defaultRenderer': 'elk'}} }%%
flowchart BT
    ydb.editor --> ydb.admin
    ydb.viewer --> ydb.editor
    ydb.auditor --> ydb.viewer
    ydb.kafkaApi.client
```

### Service roles {#service-roles}

#### ydb.auditor {#ydb-auditor}

The `ydb.auditor` role enables establishing connections to databases, viewing info on databases and access permissions granted to them, as well as on the database schema objects and backups.

Users with this role can:
* Establish [database](../concepts/resources.md#database) connections.
* View the list of databases and info on them, as well as on the [access permissions](../../iam/concepts/access-control/index.md) granted to them.
* View info on database backups and the access permissions granted to them.
* View the list of database schema objects, such as tables, indexes, and folders, and info on them.
* View info on the [quotas](../concepts/limits.md#ydb-quotas) for Managed Service for YDB.
* View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud) and [folder](../../resource-manager/concepts/resources-hierarchy.md#folder).

#### ydb.viewer {#ydb-viewer}

The `ydb.viewer` role enables establishing connections to databases and querying them for reading, viewing info on databases and access permissions granted to them, as well as on the database schema objects and backups.

Users with this role can:
* Establish connections with [databases](../concepts/resources.md#database) and query them for reading.
* View the list of databases and info on them, as well as on the [access permissions](../../iam/concepts/access-control/index.md) granted to them.
* View info on database backups and the access permissions granted to them.
* View the list of database schema objects, such as tables, indexes, and folders, and info on them.
* View info on the [quotas](../concepts/limits.md#ydb-quotas) for Managed Service for YDB.
* View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud) and [folder](../../resource-manager/concepts/resources-hierarchy.md#folder).

This role includes the `ydb.auditor` permissions.

#### ydb.editor {#ydb-editor}

The `ydb.editor` role enables managing databases, schema objects, and database backups, as well as querying DBs for both reading and writing.

Users with this role can:
* View the list of [databases](../concepts/resources.md#database), info on them and the [access permissions](../../iam/concepts/access-control/index.md) granted to them, as well as create, run, stop, modify, and delete DBs.
* Establish connections with databases and query them for reading and writing.
* View info on database backups and the access permissions granted to them, as well as create and delete them and use them to restore databases.
* View the list of schema objects, such as tables, indexes, and folders, and info on those, as well as create, modify, and delete such objects.
* View info on the [quotas](../concepts/limits.md#ydb-quotas) for Managed Service for YDB.
* View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud) and [folder](../../resource-manager/concepts/resources-hierarchy.md#folder).

This role includes the `ydb.viewer` permissions.

#### ydb.admin {#ydb-admin}

The `ydb.admin` role enables managing databases and access to them, as well as schema objects and database backups. It also allows you to query DBs for both reading and writing.

Users with this role can:
* View the list of [databases](../concepts/resources.md#database) and info on them, as well as create, run, stop, modify, and delete them.
* View info on granted [access permissions](../../iam/concepts/access-control/index.md) to databases and modify such permissions.
* Establish connections with databases and query them for reading and writing.
* View info on database backups, as well as create and delete them and use them to restore databases.
* View info on granted access permissions to backups and modify such permissions.
* View the list of schema objects, such as tables, indexes, and folders, and info on those, as well as create, modify, and delete such objects.
* View info on the [quotas](../concepts/limits.md#ydb-quotas) for Managed Service for YDB.
* View info on the relevant [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud) and [folder](../../resource-manager/concepts/resources-hierarchy.md#folder).

This role includes the `ydb.editor` permissions.

#### ydb.kafkaApi.client {#ydb-kafkaapi-client}

The `ydb.kafkaApi.client` role allows you to work with `ydb` over the [Kafka API](https://ydb.tech/docs/en/reference/kafka-api) protocol using plain authentication over an SSL connection.


### Primitive roles {#primitive-roles}

#### auditor {#auditor}

The `auditor` role grants a permission to read configuration and metadata of any Yandex Cloud resources without any access to data.

For instance, users with this role can:
* View info on a [resource](../../resource-manager/concepts/resources-hierarchy.md).
* View the resource metadata.
* View the list of operations with a resource.

`auditor` is the most secure role that does not grant any access to the [service](../../overview/concepts/services.md) data. This role suits the users who need minimum access to the Yandex Cloud resources.

#### viewer {#viewer}

The `viewer` role grants the permissions to read the info on any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md).

This role includes the `auditor` permissions.

Unlike `auditor`, the `viewer` role provides access to [service](../../overview/concepts/services.md) data in read mode.

#### editor {#editor}

The `editor` role provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md), except for assigning roles to other users, transferring [organization](../../organization/concepts/organization.md) ownership, removing an organization, and deleting Key Management Service [encryption keys](../../kms/concepts/index.md).

For instance, users with this role can create, modify, and delete resources.

This role includes the `viewer` permissions.

#### admin {#admin}

The `admin` role enables assigning any roles, except for `resource-manager.clouds.owner` and `organization-manager.organizations.owner`, and provides permissions to manage any Yandex Cloud [resources](../../resource-manager/concepts/resources-hierarchy.md) (except for transferring [organization](../../organization/concepts/organization.md) ownership and removing an organization).

Prior to assigning the `admin` role for an organization, [cloud](../../resource-manager/concepts/resources-hierarchy.md#cloud), or [billing account](../../billing/concepts/billing-account.md), make sure to check out the information on protecting [privileged accounts](../../security/standard/all.md#privileged-users).

This role includes the `editor` permissions.