Skip to main content
In addition to default groups that come with your tenant when you sign up for Nebius AI Cloud, you can create and manage custom groups in the tenant and its projects for granular control over permissions. To manage group permissions, create access permits that assign roles for specific resources to the group.

​
Prerequisites

The prerequisites for this guide depend on the interface that you use.
Make sure you are in a group that has the admin role within your tenant; for example, the default admins group. You can check this in the Administration → IAM section of the web console.

​
Setting up custom groups

To create a group and set up its permissions, go through the following steps:
  1. Create a group within your tenant or project:
    1. In the sidebar, go to https://mintcdn.com/nebius-ai-cloud/1Ha0sWR6e1mnIaHS/_assets/sidebar/administration.svg?fit=max&auto=format&n=1Ha0sWR6e1mnIaHS&q=85&s=e6411dc023fd6972922c0a12a59ccf21 Administration → IAM.
    2. Click Create entity and select Group.
    3. In the window that opens, specify the group name and define its scope by selecting either your tenant or a specific project in the tenant.
    4. Click Create to finish creating the group.
  2. Create an access permit for the group:
    1. Open the newly created group and switch to the Access permits tab.
    2. Click Manage permits.
    3. In the window that opens, select the resource that you want the group to have access to. The available resources depend on the scope of the group:
      • A group created in a tenant can have permits for the tenant, any projects and resources within it.
      • A group created in a project can only have permits for this project and resources within it.
    4. Select roles to assign to the group. These roles define the permissions of the group members.
    5. Click Save to apply your changes.
  3. Add members to the group.

​
Examples

In this example, you will create a group within a project that gives its members permissions to create, read, update or delete any resources in this project. However, the members of this group will not be able to manage groups and permissions. This set of permissions is provided by the editor role.Run the following command to create the group and an access permit, and save the group ID to an environment variable:
export PROJECT_EDITOR_GROUP_ID=$(nebius iam group create \
  --parent-id <project_ID> \
  --name my-project-editors \
  --format json \
  | jq -r ".metadata.id")

nebius iam access-permit create \
  --parent-id $PROJECT_EDITOR_GROUP_ID \
  --resource-id <project_ID> \
  --role editor
After the operation is completed, use the group ID in the PROJECT_EDITOR_GROUP_ID variable to add members to this group.
In this example, you will create a group within a tenant that gives its members permissions to view all resources in the tenant but only manage one specific MysteryBox secret. This set of permissions is provided by the viewer and editor roles for various resources.Run the following command to create the group and access permits, and save the group ID to an environment variable:
export SECRET_EDITOR_GROUP_ID=$(nebius iam group create \
  --parent-id <tenant_ID> \
  --name my-secret-editors \
  --format json \
  | jq -r ".metadata.id")

nebius iam access-permit create \
  --parent-id $SECRET_EDITOR_GROUP_ID \
  --resource-id <tenant_ID> \
  --role viewer

nebius iam access-permit create \
  --parent-id $SECRET_EDITOR_GROUP_ID \
  --resource-id <secret_ID> \
  --role editor
After the operation is completed, use the group ID in the SECRET_EDITOR_GROUP_ID variable to add members to this group.

​
Revoking role assignments

To revoke the role that you previously assigned to a group:
Remove the access permit that assigned this role:
  1. In the sidebar, go to https://mintcdn.com/nebius-ai-cloud/1Ha0sWR6e1mnIaHS/_assets/sidebar/administration.svg?fit=max&auto=format&n=1Ha0sWR6e1mnIaHS&q=85&s=e6411dc023fd6972922c0a12a59ccf21 Administration → IAM.
  2. Switch to the Groups tab and select the group you want to update.
  3. On the group page, switch to the Access permits tab.
  4. Click https://mintcdn.com/nebius-ai-cloud/1Ha0sWR6e1mnIaHS/_assets/button-vellipsis.svg?fit=max&auto=format&n=1Ha0sWR6e1mnIaHS&q=85&s=e80b8e57c43bfd117679262e6a1334ad → Manage permits next to the name of the resource.
  5. In the window that opens, deselect individual permits or click Delete permits to remove all access permits from the group.