# Яндекс Облако

Управление облаком клиента: Cloud Functions и serverless, виртуальные машины, DNS, бакеты, managed-БД, секреты, мониторинг и биллинг

## Scenarios

### Cloud resource inventory
The agent gathers virtual machines, serverless functions, buckets and DNS zones across every cloud folder into one list.

### Costs by folder
The agent breaks the cloud bill down by folder and service and shows which resources drive most of the growth in costs.

### Daily summary of changes
On a schedule, the agent reports which machines started and stopped over the past day and how costs moved in that time.

### DNS and certificate check
The agent walks through DNS zones and records, matches them against Certificate Manager certificates and names whatever is about to expire.

## How to connect

### Create a service account
Management console → “Identity and Access Management” → “Create service account”. The name is 3 to 63 characters: lowercase Latin letters, digits and hyphens.

### Grant the role on the cloud, not on a folder
Pick the cloud in the top panel → “Access bindings” tab → “Configure access” → the account → “Add role”: viewer to read, editor if the agent should change resources. A cloud role is inherited by every folder.

### Download the authorized key as JSON
On the account page: “Create new key” → “Create authorized key” → “Download file with keys”. The JSON holds id, service_account_id and private_key; the private part is shown once and cannot be recovered.

### Copy the Folder ID if you want a single folder
The folder ID is shown on the dashboard under the folder name and in the console.yandex.cloud/folders/<id> address; it starts with b1. Without it the agent works across every folder of the cloud.

## FAQ

### How do I connect Yandex Cloud?
With the JSON of an authorized key for a service account: in the console create the account under Identity and Access Management, grant a role on the cloud itself and download the key file — paste its contents into the field in full. Folder ID is optional and limits the agent to a single folder.

### What does the agent see in the cloud?
Functions and containers, virtual machines and networks, DNS zones and certificates, buckets, managed database clusters, Lockbox secrets, logs, monitoring metrics and billing — within the service account role.

### Can the agent change resources?
Yes, if the service account has the editor role: the agent calls the same API methods as the management console. With the viewer role only reading is available.

### What happens if I leave Folder ID empty?
The agent works across every folder in the cloud. The folder identifier, which starts with b1, is needed only when the work has to be limited to one folder.

[Open Яндекс Облако](https://console.yandex.cloud)