Inventory Yandex Cloud and keep it in order, folder by folder
Connect Yandex Cloud to the AI agent: virtual machines, serverless functions, DNS zones, folders and billing. The agent inventories resources and costs.
How the agent works with Яндекс Облако
Yandex Cloud has no single API address: every service lives on its own host — compute for virtual machines, mks for Kubernetes, serverless-functions and serverless-containers, vpc with its load balancers, dns and cdn, certificate-manager, storage and container-registry, mdb with ydb and trino, lockbox with kms, logging, monitoring, audit-trails, billing, resource-manager and organization-manager. The agent routes each request to the right host itself and folds the answers into a single inventory broken down by folder.
The agent starts with resource-manager: the list of clouds and folders first, because in almost every resource listing the folder identifier is a required field of the API itself rather than a convenience. If Folder ID is filled in on the connection, that step is skipped. Mutating calls come back from the cloud as an operation rather than a result, and the agent waits for it to finish on the operations host instead of treating a 200 as proof that the resource already exists.
On the read side the agent assembles an inventory by folder, matches DNS records against Certificate Manager certificates and pulls monitoring metrics, and on a schedule it reports what started and stopped over the past day. On money the API offers the billing account, budgets with thresholds and the price catalogue; line-by-line consumption is not exposed through the API at all — the cloud delivers it as an export into a bucket, and the agent says so rather than assembling a total out of fragments. It changes resources through the same API methods the console uses, but stops and asks before anything irreversible: deleting a resource, stopping a machine, editing a DNS zone. Lockbox secret values sit on a separate payload host, and the agent does not pull them unasked.
The agent exchanges the authorized key for a short-lived IAM token and refreshes it on its own, so a long inventory sweep is never cut off halfway. What is visible is bounded by the service account's role: a cloud where no role was granted stays out of reach entirely, and a service closed by permissions is told apart from an empty folder. The agent holds the call rate itself, and when a folder is empty or the role falls short it names the reason directly instead of showing an empty inventory.
Integration scenarios
Cloud resource inventory
The agent gathers virtual machines, Kubernetes and managed database clusters, serverless functions, buckets and DNS zones across every cloud folder into one list.
Budgets and spending thresholds
The agent sets a budget with alert thresholds on the billing account and shows which folders and services are bound to those thresholds.
Daily summary of changes
On a schedule, the agent reports which machines and clusters started, stopped and appeared over the past day, read from each resource's operation log.
DNS and certificate check
The agent walks through DNS zones and records, matches them against Certificate Manager certificates and names whatever is about to expire.
Why functions keep failing
The agent pulls logs and monitoring metrics for serverless functions and containers, finds the spike of errors and shows when it began and where.
Shut down idle machines
The agent matches virtual machine load metrics against their size, shows the candidates for shutdown and stops them only after your yes, waiting for the operation.
Яндекс Облако examples
Счёт вырос на 34% — 214 тыс ₽ вместо 160 тыс в июне.
- Каталог prod-analytics дал +41 тыс ₽: две новые машины c 16 vCPU
- Managed PostgreSQL перевели на диск побольше, это ещё +9 тыс ₽
- Три машины в dev крутятся круглосуточно с апреля — гасить по ночам?
Счёт за облако
Document · DOCXHow to connect
Before you connect
- A cloud in Yandex Cloud with a billing account attached
- Administrator or owner rights on that cloud
- Access to the management console at console.yandex.cloud
- 1
In IAM create a service account
Management console → “Identity and Access Management” → “Create service account”. The name is 3 to 63 characters: lowercase Latin letters, digits and hyphens.
- 2
In the cloud's Access bindings add a role
Pick the cloud in the top panel → “Access bindings” → “Configure access” → the account → “Add role”: viewer to read, editor to change resources.
- 3
On the account page download the JSON key
On the account page: “Create new key” → “Create authorized key” → “Download file with keys”. The private part is shown once and cannot be recovered.
- 4
Copy the Folder ID from the folder dashboard
The folder ID is shown on the dashboard under the folder name and in the console.yandex.cloud/folders/<id> address; it starts with b1.
FAQ
With the JSON of an authorized key for a service account: in the console create the account under Identity and Access Management, grant a role on the cloud itself and download the key file — paste its contents into the field in full. Folder ID is optional, but filling it in saves the agent from having to ask which folder on every request.
Functions, containers and API gateways, virtual machines and disks, Kubernetes and managed database clusters, networks with load balancers, DNS zones, CDN and certificates, buckets and the container registry, Lockbox secrets and KMS keys, log groups, monitoring metrics, audit trails, the billing account with its budgets and the organization with its groups — within the service account role.
No, and that is a limit of the Yandex Cloud API rather than of the connector: billing exposes the payment account, budgets with alert thresholds and the price catalogue, and no line-by-line consumption in any form. The cloud delivers that detail as a scheduled export into an Object Storage bucket; the agent will say so plainly and offer a budget threshold instead of an invented summary.
Yes, if the service account has the editor role: the agent calls the same API methods as the management console. With the viewer role only reading is available.
The folder has to be named in every request: for resource listings the folder identifier is a required field of the API itself. The agent can fetch the cloud's folder list and work across several of them, but a filled-in field removes that step — an identifier starting with b1 is then supplied automatically.