Access management in Compute Cloud
In this section, you will learn:
About access management
All transactions in Nebius Israel are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.
To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Google account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Nebius Israel.
Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.
Which resources you can assign roles to
As with other services, you can assign roles for clouds, folder and service accounts. The roles assigned for clouds and folders also apply to nested resources.
Which roles exist in the service
The chart below shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all the permissions of viewer. You can find the description of each role under the chart.
Service roles
| Role | Permissions |
|---|---|
compute.admin |
Gives rights to manage virtual machines and instance groups. |
compute.viewer |
Grants the right to view information on Compute Cloud resources. |
compute.disks.user |
Lets you use disks to create new resources, such as virtual machines. |
compute.images.user |
Lets you use images to create new resources, such as virtual machines. |
compute.operator |
Lets you stop, start, and restart virtual machines, but doesn't let you create or delete virtual machines. |
compute.snapshotSchedules.editor |
Grants the permission to create scheduled disk snapshots and update them. |
compute.snapshotSchedules.viewer |
Grants the permission to view information about scheduled disk snapshots. |
iam.serviceAccounts.user |
Verifies the right to use the service account. This role is required to perform operations with instance groups. If you enter a service account in the request, IAM checks that you have rights to use this account. |
resource-manager.clouds.member |
A role everyone requires to access cloud resources, except for cloud owners and service accounts. |
resource-manager.clouds.owner |
Grants you full access to a cloud and the resources in it. You can only assign this role for a cloud. |
For more information about service roles, see Roles in the Identity and Access Management service documentation.
Primitive roles
auditor
Grants permission to view service configuration and metadata without access to data.
viewer
Enables you to view information about resources.
editor
Allows you to manage resources, e.g., create, edit, and delete them.
admin
Allows you to manage your resources and access to them.
For more information about primitive roles, see Roles.