Access management Audit Trails

In this section, you will learn:

• Which resources you can assign roles to.
• Which roles exist in the service.

All transactions in Nebius Israel are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.

To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Google account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Nebius Israel.

Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.

Which resources you can assign roles toWhich resources you can assign roles to

In the Nebius Israel console, you can assign a role for a cloud and folder. Roles assigned for clouds or folders also apply to the trails in them.

Which roles exist in the serviceWhich roles exist in the service

The chart below shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all the permissions of viewer. You can find the description of each role under the chart.

Service rolesService roles

Role	Permissions
resource-manager.clouds.member	A role everyone requires to access cloud resources, except for cloud owners and service accounts
resource-manager.clouds.owner	Grants you full access to a cloud and the resources in it. Can only be assigned for clouds
audit-trails.auditor	Lets you view information about trails
audit-trails.viewer	Gives you access to audit logs of the trails. Includes all access rights of the audit-trails.auditor role
audit-trails.editor	Lets you manage trails (create, edit, and delete them). Includes all access rights of the audit-trails.viewer role
audit-trails.admin	Lets you manage your trails and user access to them. Includes all access rights of the audit-trails.editor role
audit-trails.configViewer (deprecated)	Lets you view information about trails. Use audit-trails.auditor instead of this role.

Primitive rolesPrimitive roles

auditorauditor

Grants permission to view service configuration and metadata without access to data.

viewerviewer

Enables you to view information about resources.

editoreditor

Allows you to manage resources, e.g., create, edit, and delete them.

adminadmin

Allows you to manage your resources and access to them.

For more information about primitive roles, see Roles.

What roles do I needWhat roles do I need

The table shows actions and minimum roles required to perform them. You can always assign a role granting broader access rights than the role from the table. For example, instead of audit-trails.configViewer, you can assign the audit-trails.editor role.

Action	Role
Viewing information about a trail	audit-trails.auditor
Collecting and viewing audit events in a trail	audit-trails.viewer
Creating a trail	audit-trails.editor
Editing a trail	audit-trails.editor
Deleting a trail	audit-trails.editor
Managing roles of other users for a trail	audit-trails.admin

What's nextWhat's next

• Review the audit log structure.