How to manage service accounts

In this guide, you will learn how to create a service account, grant it access rights, and delete it.

Prerequisites

You do not need to complete any prerequisites if you create a service account in the web console.

CLI
Terraform
Go SDK
Python SDK
JavaScript SDK

Install and configure the Nebius AI Cloud CLI.
Check that your project ID is saved in the Nebius AI Cloud CLI profile configuration:
cat ~/.nebius/config.yaml
Get the tenant ID and save it to an environment variable:
export TENANT_ID=<tenant_ID>

Creating a service account

In the sidebar, go to Administration → IAM.
Click Create resource → Service account.
In the window that opens, check the service account name and select the project.
Click Create and continue.

Create a service account and save its ID to an environment variable:

export SA_ID=$(nebius iam service-account create \
  --name <service_account_name> \
  --format jsonpath='{.metadata.id}')

Create the following configuration file:

resource "nebius_iam_v1_service_account" "<service_account_name>" {
  name        = "<service_account_name>"
  parent_id   = "<project_ID>"
  description = "My service account"
}

In the configuration, specify your Project ID.

Validate the configuration: Check that the configuration is correct:
terraform validate
If the configuration is valid, apply it: Apply the changes:
terraform apply

Create a service account and save its ID to a variable:

serviceAccountOperation, err := sdk.Services().IAM().V1().
    ServiceAccount().Create(
        ctx,
        &iam.CreateServiceAccountRequest{
            Metadata: &common.ResourceMetadata{
                Name: "<service_account_name>",
            },
            Spec: &iam.ServiceAccountSpec{},
        },
    )
if err != nil {
    return err
}
if _, err = serviceAccountOperation.Wait(ctx); err != nil {
    return err
}
serviceAccountID := serviceAccountOperation.ResourceID()

Create a service account and save its ID to a variable:

service_account_service = ServiceAccountServiceClient(sdk)
service_account_operation = await service_account_service.create(
    CreateServiceAccountRequest(
        metadata=ResourceMetadata(name="<service_account_name>"),
        spec=ServiceAccountSpec(),
    ),
)
await service_account_operation.wait()
service_account_id = service_account_operation.resource_id

Create a service account and save its ID to a variable:

const serviceAccountCreateService =
  new ServiceAccountService(sdk);
const serviceAccountOperation =
  await serviceAccountCreateService.create(
    CreateServiceAccountRequest.create({
      metadata: ResourceMetadata.create({
        name: "<service_account_name>",
      }),
      spec: ServiceAccountSpec.create({}),
    }),
  ).result;
await serviceAccountOperation.wait();
let serviceAccountId =
  serviceAccountOperation.resourceId();

Granting editor access to the service account

Make sure you are in a group that has the admin role within your tenant or project; for example, the default admins group. You can check this in the Administration → IAM section of the web console. To grant access rights to the service account:

On the Service accounts tab, locate the required service account and click → Add to group.

Get the ID of the default editors group:

nebius iam group get-by-name \
  --name editors --parent-id <tenant_ID> \
  --format jsonpath='{.metadata.id}'

In the command, specify the tenant ID.

Add the service account to the editors group:

nebius iam group-membership create \
  --parent-id <editors_group_ID> \
  --member-id <service_account_ID>

Get and copy the ID of the default editors group:

nebius iam group get-by-name \
  --name editors --parent-id <tenant_ID> \
  --format jsonpath='{.metadata.id}'

In the command, specify the tenant ID.

Add the nebius_iam_v1_group_membership resource to the configuration file. By using this resource, you add the service account to the editors group:

resource "nebius_iam_v1_group_membership" "sa_editors" {
  parent_id = "<editors_group_ID>"
  member_id = nebius_iam_v1_service_account.<service_account_name>.id
}

Check that the configuration is correct:
terraform validate
Apply the changes:
terraform apply

Get the ID of the default editors group:

editorsGroup, err := sdk.Services().IAM().V1().Group().
    GetByName(
    ctx,
    &iam.GetGroupByNameRequest{
        ParentId: "<tenant_ID>",
        Name:     "editors",
    },
)
if err != nil {
    return err
}
fmt.Println(editorsGroup.GetMetadata().GetId())

In the code, set the tenant ID.

Add the service account to the editors group:

membershipOperation, err := sdk.Services().IAM().V1().
    GroupMembership().Create(
        ctx,
        &iam.CreateGroupMembershipRequest{
            Metadata: &common.ResourceMetadata{
                ParentId: "<editors_group_ID>",
            },
            Spec: &iam.GroupMembershipSpec{
                MemberId: "<service_account_ID>",
            },
        },
    )
if err != nil {
    return err
}
if _, err = membershipOperation.Wait(ctx); err != nil {
    return err
}

Get the ID of the default editors group:

group_service = GroupServiceClient(sdk)
editors_group = await group_service.get_by_name(
    GetGroupByNameRequest(
        parent_id="<tenant_ID>",
        name="editors",
    ),
)
print(editors_group.metadata.id)

In the code, set the tenant ID.

Add the service account to the editors group:

membership_service = GroupMembershipServiceClient(sdk)
membership_operation = await membership_service.create(
    CreateGroupMembershipRequest(
        metadata=ResourceMetadata(
            parent_id="<editors_group_ID>",
        ),
        spec=GroupMembershipSpec(
            member_id="<service_account_ID>",
        ),
    ),
)
await membership_operation.wait()

Get the ID of the default editors group:

const groupService = new GroupService(sdk);
const editorsGroup = await groupService.getByName(
  GetGroupByNameRequest.create({
    parentId: "<tenant_ID>",
    name: "editors",
  }),
);
console.log(editorsGroup.metadata?.id);

In the code, set the tenant ID.

Add the service account to the editors group:

const membershipService = new GroupMembershipService(sdk);
const membershipOperation = await membershipService.create(
  CreateGroupMembershipRequest.create({
    metadata: ResourceMetadata.create({
      parentId: "<editors_group_ID>",
    }),
    spec: GroupMembershipSpec.create({
      memberId: "<service_account_ID>",
    }),
  }),
).result;
await membershipOperation.wait();

Deleting a service account

Deleting a service account cannot be reversed.

If you no longer need a service account:

Delete all resources associated with the account.
On the Service accounts tab, find the required service account and click → Delete service account.
In the window that opens, confirm the deletion.

Delete all resources associated with the account.

Get the service account ID and save it to an environment variable:

export SA_ID=$(nebius iam service-account get-by-name \
  --name <service_account_name> \
  --format jsonpath='{.metadata.id}')

Delete the service account:

nebius iam service-account delete --id $SA_ID

Delete all resources associated with the account.
Remove the corresponding nebius_iam_v1_service_account resource from the configuration file.
Check that the configuration is correct:
terraform validate
Apply the changes:
terraform apply

Delete all resources associated with the account.

Get the service account ID and save it to a variable:

serviceAccount, err := sdk.Services().IAM().V1().
    ServiceAccount().GetByName(
        ctx,
        &iam.GetServiceAccountByNameRequest{
            Name: "<service_account_name>",
        },
    )
if err != nil {
    return err
}
lookedUpServiceAccountID := serviceAccount.GetMetadata().GetId()
fmt.Println(lookedUpServiceAccountID)

Delete the service account:

deleteServiceAccount, err := sdk.Services().IAM().V1().
    ServiceAccount().Delete(
        ctx,
        &iam.DeleteServiceAccountRequest{
            Id: "<service_account_ID>",
        },
    )
if err != nil {
    return err
}
if _, err = deleteServiceAccount.Wait(ctx); err != nil {
    return err
}

Delete all resources associated with the account.

Get the service account ID and save it to a variable:

service_account_service = ServiceAccountServiceClient(sdk)
service_account = await service_account_service.get_by_name(
    GetServiceAccountByNameRequest(name="<service_account_name>"),
)
service_account_id = service_account.metadata.id
print(service_account_id)

Delete the service account:

delete_service_account_service = (
    ServiceAccountServiceClient(sdk)
)
delete_service_account = await delete_service_account_service.delete(
    DeleteServiceAccountRequest(id="<service_account_ID>"),
)
await delete_service_account.wait()

Delete all resources associated with the account.

Get the service account ID and save it to a variable:

const serviceAccountLookupService =
  new ServiceAccountService(sdk);
const serviceAccount =
  await serviceAccountLookupService.getByName(
    GetServiceAccountByNameRequest.create({
      name: "<service_account_name>",
    }),
  );
const lookedUpServiceAccountId = serviceAccount.metadata?.id;
if (!lookedUpServiceAccountId) {
  throw new Error("service account ID is missing");
}
console.log(lookedUpServiceAccountId);

Delete the service account:

const deleteServiceAccountService =
  new ServiceAccountService(sdk);
const deleteServiceAccount =
  await deleteServiceAccountService.delete(
    DeleteServiceAccountRequest.create({
      id: "<service_account_ID>",
    }),
  ).result;
await deleteServiceAccount.wait();

Nebius AI Cloud signup and payments

Identity and Access Management in Nebius AI Cloud

Overview of Nebius AI Cloud

How to manage service accounts

Prerequisites

Creating a service account

Granting editor access to the service account

Deleting a service account

​Prerequisites

​Creating a service account

​Granting editor access to the service account

​Deleting a service account

Prerequisites

Creating a service account

Granting editor access to the service account

Deleting a service account