---
metadata:
  - name: generator
    content: Diplodoc Platform v5.57.3
alternate:
  - https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/service-connections.md
  - https://sourcecraft.dev/portal/docs/ru/sourcecraft/concepts/service-connections.md
  - href: https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/service-connections.md
    type: text/markdown
    title: Markdown version
  - href: https://sourcecraft.dev/portal/docs/en/llms.txt
    type: text/markdown
    title: llms.txt
title: Service connections SourceCraft
description: How to set up service connections for secure integration of SourceCraft projects with Yandex Cloud resources.
---
> **Documentation Index:** Fetch the complete configuration index at https://sourcecraft.dev/portal/docs/en/llms.txt


# Service connections SourceCraft

<!-- source: en/_includes/sourcecraft/service-connection-info.md -->
_Service connections_ allow you to securely integrate your SourceCraft projects with the Yandex Cloud resources.

With service connections, you can get access to the Yandex Cloud [API](https://yandex.cloud/en/docs/api-design-guide/concepts/general) from inside of your SourceCraft repository's [CI/CD](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/ci-cd.md) workflows. For example, you can request a [secret](https://yandex.cloud/en/docs/lockbox/concepts/secret) from Yandex Lockbox, upload files to a Yandex Object Storage [bucket](https://yandex.cloud/en/docs/storage/concepts/bucket), deploy a [virtual machine](https://yandex.cloud/en/docs/compute/concepts/vm) in Yandex Compute Cloud, etc.

You do not have to keep any long-lived tokens or access keys in repository [secrets](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#secrets), let alone your code. You get authenticated in Yandex Cloud via a short-lived Yandex Identity and Access Management [IAM token](https://yandex.cloud/en/docs/iam/concepts/authorization/iam-token) which is requested within each individual CI/CD [task](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/ci-cd.md#tasks).
<!-- endsource: en/_includes/sourcecraft/service-connection-info.md -->

<!-- source: en/_includes/sourcecraft/service-connection-type.md -->
You can create two types of service connections:

* Organization-level: Available from all [organization](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#org) repositories if the scope is not restricted. To create such a connection, you need the [Organization admin](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/index.md#organization-manager-admin) role.
* Repository-level: Only available from a specific [repository](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#repos). To create such a connection, you need the [Repository admin](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/index.md#src-repositories-admin) role. This role grants permissions to create and modify connections for this specific repository and provides read-only access to the list of connections available to all the organization’s repositories.
<!-- endsource: en/_includes/sourcecraft/service-connection-type.md -->

Service connections are based on Identity and Access Management's [workload identity federation](https://yandex.cloud/en/docs/iam/concepts/workload-identity) functionality. Yandex Cloud resources are accessed under [service accounts](https://yandex.cloud/en/docs/iam/concepts/users/service-accounts).

A workload identity federation is created in Identity and Access Management automatically as soon as you create a service connection.

Use multiple service connections for granular access to Yandex Cloud resources. For example, you can use service accounts with different [roles](https://yandex.cloud/en/docs/iam/concepts/access-control/roles) to set up access to different [clouds](https://yandex.cloud/en/docs/resource-manager/concepts/resources-hierarchy#cloud) and [folders](https://yandex.cloud/en/docs/resource-manager/concepts/resources-hierarchy#folder) for different repositories or branches. This way you can, for example, separate your test and production environments.

For more information, see [Configuring a service connection to Yandex Cloud in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/service-connections.md).

#### Useful links {#see-also}

* [Access management in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/index.md)
* [Continuous integration and continuous deployment in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/ci-cd.md)
* [Integration with GitHub Actions in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/gh-actions.md)
* [Secrets in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#secrets)
* [Configuring a service connection to Yandex Cloud in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/service-connections.md)
* [Setting up integration with Yandex Lockbox in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/lockbox-integration.md)
* [Yandex Identity and Access Management guides](https://yandex.cloud/en/docs/iam/)
* [Yandex Cloud API concepts](https://yandex.cloud/en/docs/api-design-guide/)
* [Yandex Cloud SDK overview](https://yandex.cloud/en/docs/overview/sdk/overview)