How to add accounts to groups

To grant users and service accounts access to tenant resources, add them to one of the groups.

Prerequisites

Web console
CLI
Go SDK
Python SDK
JavaScript SDK

Make sure you are in a group that has the admin role within your tenant or project; for example, the default admins group. You can check this in the Administration → IAM section of the web console.

Install and configure the Nebius AI Cloud CLI.
Check that your project ID is saved in the Nebius AI Cloud CLI profile configuration:
cat ~/.nebius/config.yaml
Install jq to extract IDs and tokens from JSON data returned by the Nebius AI Cloud CLI:
sudo apt-get install jq
brew install jq
Make sure you are in a group that has the admin role within your tenant or project; for example, the default admins group. You can check this in the Administration → IAM section of the web console.
In the web console, go to Administration → IAM.
If the group was created in a tenant, get the tenant ID and save it to an environment variable:
export TENANT_ID=<tenant_ID>
If the group was created in a project, get the project ID and save it to an environment variable:
export PROJECT_ID=<project_ID>

Get the relevant group ID and save it to an environment variable:

export GROUP_ID=$(nebius iam group get-by-name \
  --name <group_name> \
  --parent-id <$TENANT_ID|$PROJECT_ID> \
  --format jsonpath='{.metadata.id}')

Install and initialize the Nebius SDK for Go.
Make sure you are in a group that has the admin role within your tenant or project; for example, the default admins group. You can check this in the Administration → IAM section of the web console.
If the group was created in a tenant, get the tenant ID.
If the group was created in a project, get the project ID.

Get the relevant group ID:

group, err := sdk.Services().IAM().V1().Group().GetByName(
    ctx,
    &iam.GetGroupByNameRequest{
        Name: "<group_name>",
        ParentId: "<tenant_ID|project_ID>",
    },
)
if err != nil {
    return err
}
groupID := group.GetMetadata().GetId()
fmt.Println(groupID)

Set the group’s name in Name and its tenant or project ID in ParentId.

Install and initialize the Nebius SDK for Python.
Make sure you are in a group that has the admin role within your tenant or project; for example, the default admins group. You can check this in the Administration → IAM section of the web console.
If the group was created in a tenant, get the tenant ID.
If the group was created in a project, get the project ID.

Get the relevant group ID:

group_service = GroupServiceClient(sdk)
group = await group_service.get_by_name(
    GetGroupByNameRequest(
        name="<group_name>",
        parent_id="<tenant_ID|project_ID>",
    ),
)
group_id = group.metadata.id
print(group_id)

Set the group’s name in name and its tenant or project ID in parent_id.

Install and initialize the Nebius SDK for JavaScript.
Make sure you are in a group that has the admin role within your tenant or project; for example, the default admins group. You can check this in the Administration → IAM section of the web console.
If the group was created in a tenant, get the tenant ID.
If the group was created in a project, get the project ID.

Get the relevant group ID:

const groupService = new GroupService(sdk);
const group = await groupService.getByName(
  GetGroupByNameRequest.create({
    name: "<group_name>",
    parentId: "<tenant_ID|project_ID>",
  }),
);
const groupId = group.metadata?.id;
console.log(groupId);

Set the group’s name in name and its tenant or project ID in parentId.

Adding a user account

Web console
CLI
Go SDK
Python SDK
JavaScript SDK

To add a user to a group:

In the sidebar, go to Administration → IAM.
On the Groups tab, click the group you want to add a user to.
Click Add members.
In the window that opens:
- To add an existing tenant member, find the user and click Add next to their name.
- To invite a new user, type their full email address and click Invite user. The invitation is valid for three days, and you can track it on the Users tab. For more information, see User invitations.

To add a user to a group via the Nebius AI Cloud CLI, you must have their email address.

Save a user email to an environment variable:
export USER_EMAIL=<user_email>

Get the user account ID and save it to an environment variable:

export USER_ID=$(nebius iam tenant-user-account-with-attributes list \
  --parent-id $TENANT_ID --all \
  --format json | jq -r --arg user_email "$USER_EMAIL" \
  '[.items[] | select(.attributes.email == $user_email)
  | .tenant_user_account.metadata.id] | first')

With --all, the command returns the full list of user accounts instead of only the first page of results that may not contain the required user account.

To add the user account to the group, set up its membership:

nebius iam group-membership create \
  --parent-id $GROUP_ID \
  --member-id $USER_ID

Check that the account has appeared in the group:

nebius iam group-membership list-members \
  --parent-id $GROUP_ID | grep "$USER_ID"

To add a user to a group, you must have their email address.

Get the user account ID:

var userID string
pageToken := ""
for {
    userAccounts, err := sdk.Services().IAM().V1().
        TenantUserAccountWithAttributes().List(
            ctx,
            &iam.ListTenantUserAccountsWithAttributesRequest{
                ParentId:  tenantID,
                PageSize:  1000,
                PageToken: pageToken,
            },
        )
    if err != nil {
        return err
    }
    for _, account := range userAccounts.GetItems() {
        if account.GetAttributes().GetEmail() == userEmail {
            userID = account.GetTenantUserAccount().
                GetMetadata().GetId()
            break
        }
    }
    if userID != "" {
        break
    }
    pageToken = userAccounts.GetNextPageToken()
    if pageToken == "" {
        break
    }
}
if userID == "" {
    return fmt.Errorf("user not found: %s", userEmail)
}
fmt.Println(userID)

The SDK has no parameter to fetch the full list of user accounts at once, so the code requests each subsequent page in a for loop by using the PageToken parameter until it finds an account whose Attributes.Email matches the required email address.

To add the user account to the group, set up its membership:

membershipOp, err := sdk.Services().IAM().V1().
    GroupMembership().Create(
        ctx,
        &iam.CreateGroupMembershipRequest{
            Metadata: &common.ResourceMetadata{
                ParentId: "<group_ID>",
            },
            Spec: &iam.GroupMembershipSpec{
                MemberId: "<user_ID>",
            },
        },
    )
if err != nil {
    return err
}
if _, err = membershipOp.Wait(ctx); err != nil {
    return err
}

Set the group ID in Metadata.ParentId and the user account ID in Spec.MemberId.

Check that the account has appeared in the group:

userMembershipLookupService := sdk.Services().IAM().V1().
    GroupMembership()
userMemberships, err := userMembershipLookupService.ListMembers(
    ctx,
    &iam.ListGroupMembershipsRequest{ParentId: "<group_ID>"},
)
if err != nil {
    return err
}
found := false
for _, membership := range userMemberships.GetMemberships() {
    if membership.GetSpec().GetMemberId() == "<user_ID>" {
        fmt.Println(membership)
        found = true
        break
    }
}
if !found {
    return fmt.Errorf(
        "user is not a group member: %s",
        "<user_ID>",
    )
}

The code lists the group’s memberships and checks each membership’s Spec.MemberId against the user account ID.

To add a user to a group, you must have their email address.

Get the user account ID:

user_account_service = (
    TenantUserAccountWithAttributesServiceClient(sdk)
)
page_token = ""
user_id = ""
while True:
    user_accounts = await user_account_service.list(
        ListTenantUserAccountsWithAttributesRequest(
            parent_id=tenant_id,
            page_size=1000,
            page_token=page_token,
        ),
    )
    for item in user_accounts.items:
        if item.attributes.email == user_email:
            user_id = item.tenant_user_account.metadata.id
            break
    if user_id or not user_accounts.next_page_token:
        break
    page_token = user_accounts.next_page_token
if not user_id:
    raise RuntimeError(f"user not found: {user_email}")
print(user_id)

The SDK has no parameter to fetch the full list of user accounts at once, so the code requests each subsequent page in a while loop by using the page_token parameter until it finds an account whose attributes.email matches the required email address.

To add the user account to the group, set up its membership:

membership_service = GroupMembershipServiceClient(sdk)
membership_operation = await membership_service.create(
    CreateGroupMembershipRequest(
        metadata=ResourceMetadata(parent_id="<group_ID>"),
        spec=GroupMembershipSpec(member_id="<user_ID>"),
    ),
)
await membership_operation.wait()

Set the group ID in metadata.parent_id and the user account ID in spec.member_id.

Check that the account has appeared in the group:

membership_service = GroupMembershipServiceClient(sdk)
memberships = await membership_service.list_members(
    ListGroupMembershipsRequest(parent_id="<group_ID>"),
)
user_membership = next(
    (
        item for item in memberships.memberships
        if item.spec.member_id == "<user_ID>"
    ),
    None,
)
if user_membership is None:
    raise RuntimeError(
        "user is not a group member: " + "<user_ID>"
    )
print(user_membership)

The code lists the group’s memberships and checks each membership’s spec.member_id against the user account ID.

To add a user to a group, you must have their email address.

Get the user account ID:

const userAccountService =
  new TenantUserAccountWithAttributesService(sdk);
let userId = "";
let pageToken = "";
while (true) {
  const userAccounts = await userAccountService.list(
    ListTenantUserAccountsWithAttributesRequest.create({
      parentId: tenantId,
      pageSize: 1000,
      pageToken,
    }),
  ).result;
  userId = userAccounts.items.find(
    (item) =>
      item.attributesOptional?.$case === "attributes" &&
      item.attributesOptional.attributes.email === userEmail,
  )?.tenantUserAccount?.metadata?.id ?? "";
  if (userId || !userAccounts.nextPageToken) {
    break;
  }
  pageToken = userAccounts.nextPageToken;
}
if (!userId) {
  throw new Error(`user not found: ${userEmail}`);
}
console.log(userId);

The SDK has no parameter to fetch the full list of user accounts at once, so the code requests each subsequent page in a while loop by using the pageToken parameter until it finds an account whose attributes.email matches the required email address.

To add the user account to the group, set up its membership:

const userMembershipService =
  new GroupMembershipService(sdk);
const userMembershipOperation = await userMembershipService.create(
  CreateGroupMembershipRequest.create({
    metadata: ResourceMetadata.create({
      parentId: "<group_ID>",
    }),
    spec: GroupMembershipSpec.create({memberId: "<user_ID>"}),
  }),
).result;
await userMembershipOperation.wait();

Set the group ID in metadata.parentId and the user account ID in spec.memberId.

Check that the account has appeared in the group:

const userMembershipLookupService =
  new GroupMembershipService(sdk);
const userMemberships = await userMembershipLookupService.listMembers(
  ListGroupMembershipsRequest.create({parentId: "<group_ID>"}),
).result;
const userMembership = userMemberships.memberships.find(
  (item) => item.spec?.memberId === "<user_ID>",
);
if (!userMembership) {
  throw new Error(
    "user is not a group member: " + "<user_ID>",
  );
}
console.log(userMembership);

The code lists the group’s memberships and checks each membership’s spec.memberId against the user account ID.

Adding a service account

Web console
CLI
Go SDK
Python SDK
JavaScript SDK

To add a service account to a group:

In the sidebar, go to Administration → IAM.
On the Groups tab, click the group you want to add a service account to.
Click Add members.
In the window that opens, switch to the Service accounts tab.
Find the service account you want to add to the group and click Add next to its name.

To add a service account to a group via the Nebius AI Cloud CLI, you must have its name.

Get the service account ID and save it to an environment variable:

export SA_ID=$(nebius iam service-account get-by-name \
  --name <service_account_name> \
  --format jsonpath='{.metadata.id}')

Set up the account membership in the group:

nebius iam group-membership create \
  --parent-id $GROUP_ID \
  --member-id $SA_ID

Check that the account has appeared in the group:

nebius iam group-membership list-members \
  --parent-id $GROUP_ID | grep "$SA_ID"

If you don’t know the name of the service account:

View all service accounts for your project:
nebius iam service-account list
Get the service account ID and save it to an environment variable. If the required service account does not appear as the first item in the previous command output, change the digit in .items[0].metadata.id:
export SA_ID=$(nebius iam service-account list \ --format jsonpath='{.items[0].metadata.id}')

Set up the account membership in the group:

nebius iam group-membership create \
  --parent-id $GROUP_ID \
  --member-id $SA_ID

Check that the new account has appeared in the group:

nebius iam group-membership list-members \
  --parent-id $GROUP_ID | grep "$SA_ID"

To add a service account to a group, you must have its name.

Get the service account ID:

serviceAccount, err := sdk.Services().IAM().V1().
    ServiceAccount().GetByName(
        ctx,
        &iam.GetServiceAccountByNameRequest{
            Name: "<service_account_name>",
        },
    )
if err != nil {
    return err
}
serviceAccountID := serviceAccount.GetMetadata().GetId()
fmt.Println(serviceAccountID)

Set the service account’s name in Name.

Set up the account membership in the group:

secondMembershipService := sdk.Services().IAM().V1().
    GroupMembership()
secondMembershipOperation, err := secondMembershipService.Create(
    ctx,
    &iam.CreateGroupMembershipRequest{
        Metadata: &common.ResourceMetadata{
            ParentId: "<group_ID>",
        },
        Spec: &iam.GroupMembershipSpec{
            MemberId: "<service_account_ID>",
        },
    },
)
if err != nil {
    return err
}
if _, err = secondMembershipOperation.Wait(ctx); err != nil {
    return err
}

Set the group ID in Metadata.ParentId and the service account ID in Spec.MemberId.

Check that the account has appeared in the group:

secondMembershipLookup := sdk.Services().IAM().V1().
    GroupMembership()
secondMemberships, err := secondMembershipLookup.ListMembers(
    ctx,
    &iam.ListGroupMembershipsRequest{ParentId: "<group_ID>"},
)
if err != nil {
    return err
}
foundSecondServiceAccount := false
for _, membership := range secondMemberships.GetMemberships() {
    if membership.GetSpec().GetMemberId() == "<service_account_ID>" {
        fmt.Println(membership)
        foundSecondServiceAccount = true
        break
    }
}
if !foundSecondServiceAccount {
    return fmt.Errorf(
        "second service account is not a group member: %s",
        "<service_account_ID>",
    )
}

The code lists the group’s memberships and checks each membership’s Spec.MemberId against the service account ID.

If you don’t know the name of the service account:

List all service accounts:

serviceAccountListService := sdk.Services().IAM().V1().
    ServiceAccount()
allServiceAccounts, err := serviceAccountListService.List(
    ctx,
    &iam.ListServiceAccountRequest{},
)
if err != nil {
    return err
}
fmt.Println(allServiceAccounts)

Get the ID of the first service account in the list. If the required service account is not the first item, change the index in GetItems()[0]:

listedServiceAccounts, err := sdk.Services().IAM().V1().
    ServiceAccount().List(
        ctx,
        &iam.ListServiceAccountRequest{},
    )
if err != nil {
    return err
}
if len(listedServiceAccounts.GetItems()) == 0 {
    return fmt.Errorf("service account not found")
}
listedServiceAccountID := listedServiceAccounts.GetItems()[0].
    GetMetadata().GetId()
if listedServiceAccountID == "" {
    return fmt.Errorf("service account ID is missing")
}
fmt.Println(listedServiceAccountID)

Set up the account membership in the group:

serviceAccountMembershipService := sdk.Services().
    IAM().V1().GroupMembership()
serviceAccountMembershipOperation, err :=
    serviceAccountMembershipService.Create(
        ctx,
        &iam.CreateGroupMembershipRequest{
            Metadata: &common.ResourceMetadata{
                ParentId: "<group_ID>",
            },
            Spec: &iam.GroupMembershipSpec{
                MemberId: "<service_account_ID>",
            },
        },
    )
if err != nil {
    return err
}
if _, err = serviceAccountMembershipOperation.Wait(ctx); err != nil {
    return err
}

Set the group ID in Metadata.ParentId and the service account ID in Spec.MemberId.

Check that the new account has appeared in the group:

serviceAccountMembershipLookup := sdk.Services().
    IAM().V1().GroupMembership()
serviceAccountMemberships, err :=
    serviceAccountMembershipLookup.ListMembers(
        ctx,
        &iam.ListGroupMembershipsRequest{
            ParentId: "<group_ID>",
        },
    )
if err != nil {
    return err
}
foundServiceAccount := false
for _, membership := range serviceAccountMemberships.
    GetMemberships() {
    if membership.GetSpec().GetMemberId() == "<service_account_ID>" {
        fmt.Println(membership)
        foundServiceAccount = true
        break
    }
}
if !foundServiceAccount {
    return fmt.Errorf(
        "service account is not a group member: %s",
        "<service_account_ID>",
    )
}

The code lists the group’s memberships and checks each membership’s Spec.MemberId against the service account ID.

To add a service account to a group, you must have its name.

Get the service account ID:

service_account_service = ServiceAccountServiceClient(sdk)
service_account = await service_account_service.get_by_name(
    GetServiceAccountByNameRequest(name="<service_account_name>"),
)
service_account_id = service_account.metadata.id
print(service_account_id)

Set the service account’s name in name.

Set up the account membership in the group:

second_membership_service = (
    GroupMembershipServiceClient(sdk)
)
second_membership_operation = (
    await second_membership_service.create(
        CreateGroupMembershipRequest(
            metadata=ResourceMetadata(parent_id="<group_ID>"),
            spec=GroupMembershipSpec(
                member_id="<service_account_ID>",
            ),
        ),
    )
)
await second_membership_operation.wait()

Set the group ID in metadata.parent_id and the service account ID in spec.member_id.

Check that the account has appeared in the group:

second_membership_lookup = GroupMembershipServiceClient(sdk)
second_memberships = await second_membership_lookup.list_members(
    ListGroupMembershipsRequest(parent_id="<group_ID>"),
)
second_membership = next(
    (
        item for item in second_memberships.memberships
        if item.spec.member_id == "<service_account_ID>"
    ),
    None,
)
if second_membership is None:
    raise RuntimeError(
        "second service account is not a group member: " +
        "<service_account_ID>"
    )
print(second_membership)

The code lists the group’s memberships and checks each membership’s spec.member_id against the service account ID.

If you don’t know the name of the service account:

List all service accounts:

service_account_list_service = (
    ServiceAccountServiceClient(sdk)
)
service_accounts = await service_account_list_service.list(
    ListServiceAccountRequest(),
)
print(service_accounts)

Get the ID of the first service account in the list. If the required service account is not the first item, change the index in items[0]:

service_account_list_service = (
    ServiceAccountServiceClient(sdk)
)
listed_service_accounts = (
    await service_account_list_service.list(
        ListServiceAccountRequest(),
    )
)
if not listed_service_accounts.items:
    raise RuntimeError("service account not found")
service_account_id = listed_service_accounts.items[0].metadata.id
print(service_account_id)

Set up the account membership in the group:

service_account_membership_service = (
    GroupMembershipServiceClient(sdk)
)
service_account_membership_operation = (
    await service_account_membership_service.create(
        CreateGroupMembershipRequest(
            metadata=ResourceMetadata(parent_id="<group_ID>"),
            spec=GroupMembershipSpec(
                member_id="<service_account_ID>",
            ),
        ),
    )
)
await service_account_membership_operation.wait()

Set the group ID in metadata.parent_id and the service account ID in spec.member_id.

Check that the new account has appeared in the group:

service_account_membership_lookup = (
    GroupMembershipServiceClient(sdk)
)
service_account_memberships = (
    await service_account_membership_lookup.list_members(
        ListGroupMembershipsRequest(parent_id="<group_ID>"),
    )
)
service_account_membership = next(
    (
        item for item in service_account_memberships.memberships
        if item.spec.member_id == "<service_account_ID>"
    ),
    None,
)
if service_account_membership is None:
    raise RuntimeError(
        "service account is not a group member: " +
        "<service_account_ID>"
    )
print(service_account_membership)

The code lists the group’s memberships and checks each membership’s spec.member_id against the service account ID.

To add a service account to a group, you must have its name.

Get the service account ID:

const serviceAccountService =
  new ServiceAccountService(sdk);
const serviceAccount = await serviceAccountService.getByName(
  GetServiceAccountByNameRequest.create({name: "<service_account_name>"}),
);
let serviceAccountId = serviceAccount.metadata?.id;
if (!serviceAccountId) {
  throw new Error("service account ID is missing");
}
console.log(serviceAccountId);

Set the service account’s name in name.

Set up the account membership in the group:

const secondMembershipService =
  new GroupMembershipService(sdk);
const secondMembershipOperation =
  await secondMembershipService.create(
    CreateGroupMembershipRequest.create({
      metadata: ResourceMetadata.create({
        parentId: "<group_ID>",
      }),
      spec: GroupMembershipSpec.create({
        memberId: "<service_account_ID>",
      }),
    }),
  ).result;
await secondMembershipOperation.wait();

Set the group ID in metadata.parentId and the service account ID in spec.memberId.

Check that the account has appeared in the group:

const secondMembershipLookup =
  new GroupMembershipService(sdk);
const secondMemberships =
  await secondMembershipLookup.listMembers(
    ListGroupMembershipsRequest.create({
      parentId: "<group_ID>",
    }),
  ).result;
const secondMembership = secondMemberships.memberships.find(
  (item) => item.spec?.memberId === "<service_account_ID>",
);
if (!secondMembership) {
  throw new Error(
    "second service account is not a group member: " +
    "<service_account_ID>",
  );
}
console.log(secondMembership);

The code lists the group’s memberships and checks each membership’s spec.memberId against the service account ID.

If you don’t know the name of the service account:

List all service accounts:

const serviceAccountListService =
  new ServiceAccountService(sdk);
const allServiceAccounts = await serviceAccountListService.list(
  ListServiceAccountRequest.create({}),
);
console.log(allServiceAccounts);

Get the ID of the first service account in the list. If the required service account is not the first item, change the index in items[0]:

const getServiceAccountListService =
  new ServiceAccountService(sdk);
const listedServiceAccounts =
  await getServiceAccountListService.list(
    ListServiceAccountRequest.create({}),
  );
if (!listedServiceAccounts.items.length) {
  throw new Error("service account not found");
}
const listedServiceAccountId =
  listedServiceAccounts.items[0].metadata?.id;
if (!listedServiceAccountId) {
  throw new Error("service account ID is missing");
}
console.log(listedServiceAccountId);

Set up the account membership in the group:

const serviceAccountMembershipService =
  new GroupMembershipService(sdk);
const serviceAccountMembershipOperation =
  await serviceAccountMembershipService.create(
    CreateGroupMembershipRequest.create({
      metadata: ResourceMetadata.create({
        parentId: "<group_ID>",
      }),
      spec: GroupMembershipSpec.create({
        memberId: "<service_account_ID>",
      }),
    }),
  ).result;
await serviceAccountMembershipOperation.wait();

Set the group ID in metadata.parentId and the service account ID in spec.memberId.

Check that the new account has appeared in the group:

const serviceAccountMembershipLookup =
  new GroupMembershipService(sdk);
const serviceAccountMemberships =
  await serviceAccountMembershipLookup.listMembers(
    ListGroupMembershipsRequest.create({
      parentId: "<group_ID>",
    }),
  ).result;
const serviceAccountMembership =
  serviceAccountMemberships.memberships.find(
  (item) => item.spec?.memberId === "<service_account_ID>",
);
if (!serviceAccountMembership) {
  throw new Error(
    "service account is not a group member: " +
    "<service_account_ID>",
  );
}
console.log(serviceAccountMembership);

The code lists the group’s memberships and checks each membership’s spec.memberId against the service account ID.

Nebius AI Cloud signup and payments

Identity and Access Management in Nebius AI Cloud

Overview of Nebius AI Cloud

How to add accounts to groups

Prerequisites

Adding a user account

Adding a service account

​Prerequisites

​Adding a user account

​Adding a service account

Prerequisites

Adding a user account

Adding a service account