---
metadata:
- name: generator
content: Diplodoc Platform v5.57.3
alternate:
- https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/service-connections.md
- https://sourcecraft.dev/portal/docs/ru/sourcecraft/operations/service-connections.md
- href: https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/service-connections.md
type: text/markdown
title: Markdown version
- href: https://sourcecraft.dev/portal/docs/en/llms.txt
type: text/markdown
title: llms.txt
title: Configuring a service connection to Yandex Cloud in SourceCraft
description: Follow this guide to set up a service connection for secure integration of SourceCraft projects with Yandex Cloud resources.
---
> **Documentation Index:** Fetch the complete configuration index at https://sourcecraft.dev/portal/docs/en/llms.txt
# Configuring a service connection to Yandex Cloud in SourceCraft
_Service connections_ allow you to securely integrate your SourceCraft projects with the Yandex Cloud resources.
With service connections, you can get access to the Yandex Cloud [API](https://yandex.cloud/en/docs/api-design-guide/concepts/general) from inside of your SourceCraft repository's [CI/CD](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/ci-cd.md) workflows. For example, you can request a [secret](https://yandex.cloud/en/docs/lockbox/concepts/secret) from Yandex Lockbox, upload files to a Yandex Object Storage [bucket](https://yandex.cloud/en/docs/storage/concepts/bucket), deploy a [virtual machine](https://yandex.cloud/en/docs/compute/concepts/vm) in Yandex Compute Cloud, etc.
You do not have to keep any long-lived tokens or access keys in repository [secrets](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#secrets), let alone your code. You get authenticated in Yandex Cloud via a short-lived Yandex Identity and Access Management [IAM token](https://yandex.cloud/en/docs/iam/concepts/authorization/iam-token) which is requested within each individual CI/CD [task](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/ci-cd.md#tasks).
Learn more about [service connections](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/service-connections.md).
This guide will use the example of getting a list of Yandex Cloud Functions [functions](https://yandex.cloud/en/docs/functions/concepts/function).
To configure a service connection:
1. [Create a service account Yandex Cloud named](#create-sa).
1. [Assign a role to the service account](#grant-role).
1. [Create a service connection](#create-service-connection).
1. [Prepare the CI/CD configuration](#prepare-ci-cd).
1. [Test the service connection](#check).
## Create a Yandex Cloud service account {#create-sa}
A [service account](https://yandex.cloud/en/docs/iam/concepts/users/service-accounts) is an account that can be used by a program to manage resources in Yandex Cloud.
To create a service account:
1. In the Yandex Cloud [management console](https://console.yandex.cloud), select the [folder](https://yandex.cloud/en/docs/resource-manager/concepts/resources-hierarchy) containing resources you want to configure access to from SourceCraft.
1. [Navigate](https://yandex.cloud/en/docs/console/operations/select-service.md#select-service) to **Identity and Access Management**.
1. Click **Create service account**.
1. Enter a name for the service account.
The naming requirements are as follows:
* Length: between 3 and 63 characters.
* It can only contain lowercase Latin letters, numbers, and hyphens.
* It must start with a letter and cannot end with a hyphen.
Make sure the service account name is unique within your cloud.
1. Click **Create**.
For more information, see [Creating a service account](https://yandex.cloud/en/docs/iam/operations/sa/create).
## Assign a role to the service account {#grant-role}
A [role](https://yandex.cloud/en/docs/iam/concepts/access-control/roles) is a set of permissions that defines the allowed scope of operations with Yandex Cloud resources.
To assign a role for a folder to a service account:
1. In the Yandex Cloud [management console](https://console.yandex.cloud), select the folder with the service account you created earlier.
1. Navigate to the **Access bindings** tab.
1. Click **Configure access**.
1. In the window that opens, select **Service accounts**.
1. Select the service account from the list or use the search bar.
1. Click  **Add role** and select the role from the list or use the search bar.
For example, assign the `functions.viewer` [role](https://yandex.cloud/en/docs/functions/security/#functions-viewer) to the service account to enable it to view Cloud Functions functions.
1. Click **Save**.
Learn more about [assigning roles to a service account](https://yandex.cloud/en/docs/iam/operations/sa/assign-role-for-sa).
## Create a service connection {#create-service-connection}
You can create two types of service connections:
* Organization-level: Available from all [organization](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#org) repositories if the scope is not restricted. To create such a connection, you need the [Organization admin](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/index.md#organization-manager-admin) role.
* Repository-level: Only available from a specific [repository](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#repos). To create such a connection, you need the [Repository admin](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/index.md#src-repositories-admin) role. This role grants permissions to create and modify connections for this specific repository and provides read-only access to the list of connections available to all the organization’s repositories.
{% list tabs group=instructions %}
- Organization level {#organization}
1. Open the SourceCraft [home page](https://sourcecraft.dev).
1. Navigate to the  **Organizations** tab.
1. Select the [organization](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#org).
1. On the organization page, under  **Settings**, go to the  **Service connections** section.
1. Click **New service connection**.
1. In the window that opens:
* Under **Basic information**, give the connection a name, e.g., `default-service-connection`, and, optionally, provide a description.
* Under **Scope**, select the repositories and branches the service connection will be available to.
* Under **Yandex Cloud settings**, select:
* Folder containing the resources you want to configure access to from SourceCraft.
* Service account you created earlier.
{% note tip %}
To re-request the list of clouds, folders, and service accounts from Yandex Cloud, click  **Synchronize**. This can be of use if alongside creating a service connection you also created a folder or service account.
{% endnote %}
1. Click **Create service connection**.
- Repository level {#repository}
1. Open the SourceCraft [home page](https://sourcecraft.dev).
1. On the  **Home** tab, under  **Your craftspace**, navigate to  **Repositories**.
1. Select a repository.
1. Under  **Repository settings** on the repository page, go to  **Service connections**.
1. Click **New service connection**.
1. In the window that opens:
* Under **Basic information**, give the connection a name, e.g., `default-service-connection`, and, optionally, provide a description.
* Under **Scope**, select the branches the service connection will be available to.
* Under **Yandex Cloud settings**, select:
* Folder containing the resources you want to configure access to from SourceCraft.
* Service account you created earlier.
{% note tip %}
To re-request the list of clouds, folders, and service accounts from Yandex Cloud, click  **Synchronize**. This can be of use if alongside creating a service connection you also created a folder or service account.
{% endnote %}
1. Click **Create service connection**.
{% endlist %}
Wait for the operation to complete. The page that opens will display the service connection details.
A Yandex Identity and Access Management [workload identity federation](https://yandex.cloud/en/docs/iam/concepts/workload-identity) will be automatically created in Yandex Cloud.
To view the parameters of the new OIDC provider, click the federation name under  **Workload identity federation**.
## Prepare the CI/CD configuration {#prepare-ci-cd}
{% note tip %}
You can set up and view repository configurations in the SourceCraft interface under  **Repository settings** in the  **Configurations** section. Learn more in [this article](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/configuration-edit.md).
{% endnote %}
1. [Configure](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/ci-cd.md) CI/CD in your repository.
1. Open the SourceCraft [home page](https://sourcecraft.dev).
1. On the  **Home** tab, under  **Your craftspace**, navigate to  **Repositories** and select your repository.
1. Under  **Code** on the repository page, go to  **Branches**.
1. Select the branch for editing.
1. Open the `.sourcecraft/ci.yaml` file.
1. In the top-right corner, click  **Edit**.
1. Add the `tokens` and `env` sections you got earlier into the CI/CD configuration.
You can get an IAM token via a ready-made cube from the SourceCraft team. Below is an example of a CI/CD configuration where the IAM token is used for authentication in the Yandex Cloud CLI to get a list of Cloud Functions functions.
```yaml
tokens:
# Token name (can be any).
:
# Name of the service connection you created earlier.
service_connection:
# Requested access scope:
# org: All repositories
# repo: Specific repository
# ref: Branch or tag
scope: repo
workflows:
test-workflow:
tasks:
- name: sample-task
cubes:
# The cube exchanges the SourceCraft token for the Yandex Cloud IAM token
# and saves it to the IAM_TOKEN variable within the outputs section.
- name: get-iam-token
env:
ID_TOKEN: ${{ tokens..id_token }}
YC_SA_ID: ${{ tokens..service_account_id }}
# You can also get the folder and cloud IDs
# YC_FOLDER_ID: ${{ tokens..folder_id }}
# YC_CLOUD_ID: ${{ tokens..cloud_id }}
image: cr.yandex/sourcecraft/yc-iam:latest
# The cube with pre-installed Yandex Cloud CLI retrieves
# the IAM_TOKEN from `outputs` and uses it to get the list of Cloud Functions functions.
- name: get-functions
env:
# In the outputs section, insert the name of the IAM token cube,
# e.g., get-iam-token.
YC_IAM_TOKEN: ${{ cubes..outputs.IAM_TOKEN }}
YC_FOLDER_ID: ${{ tokens..folder_id }}
image:
name: cr.yandex/sourcecraft/yc-cli:latest
entrypoint: ""
script:
- |
yc config set folder-id $YC_FOLDER_ID
yc serverless function list
on:
push: test-workflow
```
{% note tip %}
You can interact with Yandex Cloud directly via the API or use one of the following:
* [Yandex Cloud CLI](https://yandex.cloud/en/docs/cli/): For authentication, provide the IAM token to the `YC_IAM_TOKEN` environment variable, and use the `--cloud-id` and `--folder-id` parameters for cloud and folder IDs in the commands.
* [Terraform](https://yandex.cloud/en/docs/terraform/): For authentication, provide the IAM token to the `YC_TOKEN` environment variable; provide cloud and folder IDs to the `YC_CLOUD_ID` and `YC_FOLDER_ID` environment variables.
* [SDK](https://yandex.cloud/en/docs/overview/sdk/overview): Authentication is similar to the API.
{% endnote %}
1. In the top-right corner, click **Commit changes**.
1. In the window that opens, configure the procedure for changes:
* In the **Commit message** field, give a comment that will describe the changes you make.
* Under **Commit branch**, select the branch you want to change. Create a new branch as needed.
* Under **After commit action**, select how to make changes: via a commit or a [pull request](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#pr).
1. Confirm your changes.
If you opted for a pull request, [finish](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/pr-create.md) creating it.
## Test the service connection {#check}
1. Under  **Code** on the repository page, go to  **CI/CD**.
1. Select a running workflow.
1. The page that opens will display the workflow tasks, cubes (task steps), as well as statuses and execution results.
1. In the bottom-right corner of the `get-functions` cube, click .
Here is an example of the `get-functions` cube logs:
```bash
+----------------------+--------+----------------------+--------+
| ID | NAME | FOLDER ID | STATUS |
+----------------------+--------+----------------------+--------+
| d4e5l4qjepst******** | test-1 | b1gveg9vude9******** | ACTIVE |
+----------------------+--------+----------------------+--------+
```
{% note tip %}
An IAM token is valid for 12 hours. However, we recommend terminating it after use for security purposes. For more information, see [Revoking an IAM token](https://yandex.cloud/en/docs/iam/operations/iam-token/revoke-iam-token).
{% endnote %}
#### Useful links {#see-also}
* [Service connections SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/service-connections.md)
* [Integration with GitHub Actions in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/gh-actions.md)
* [Access management in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/security/index.md)
* [Continuous integration and continuous deployment in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/ci-cd.md)
* [Secrets in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#secrets)
* [Setting up integration with Yandex Lockbox in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/lockbox-integration.md)
* [Yandex Identity and Access Management guides](https://yandex.cloud/en/docs/iam/)
* [Yandex Cloud API concepts](https://yandex.cloud/en/docs/api-design-guide/)
* [Yandex Cloud SDK overview](https://yandex.cloud/en/docs/overview/sdk/overview)