Yandex Cloud

Connect OpenSRE to a Yandex Cloud folder

OpenSRE reads a Yandex Cloud folder to investigate incidents in it. This page covers connecting the account and what OpenSRE can read once connected.

What OpenSRE reads

Once the folder is connected, an investigation can reach:

Area	What it answers
Monitoring	metric series for a query, and which metric names and labels exist
Cloud Logging	log entries in a group, filtered by level and time, and which groups exist
Compute	which instances exist and which are stopped, plus serial console output
Load balancers	which network or application balancer targets are unhealthy
Everything else	any readable resource — container registry, DNS, KMS, Lockbox, YDB, certificates and the rest — looked up by name and read through the generic reader

The last row matters more than it looks: OpenSRE ships an index of every read endpoint the Yandex Cloud API exposes, so a service without a dedicated tool is still reachable. Audit Trails is in that index, so trails and their settings are readable now; the audit events are not, because Yandex delivers them to a sink rather than through the API.

Reading log entries needs one extra package. Cloud Logging is the only Yandex Cloud read with no REST endpoint, so it uses Yandex’s gRPC stubs:

pip install 'opensre[yandex_cloud_logs]'

Everything else — including listing log groups — works without it. Log entries are kept for at most 31 days, and reads are limited to five per second.

OpenSRE never changes anything in your cloud. When an investigation concludes that something needs doing, it reports the exact yc command for you to run.

What you need

A folder ID. Every Yandex Cloud read is folder-scoped — the Monitoring API rejects cross-folder queries outright — so nothing works without it. Take it from the console URL, or run:

yc config get folder-id

One credential. Four kinds work, in the order you would normally reach for them:

Credential	Use it when
Service-account key file	the normal choice for anything unattended
Service-account key, inline	same, where there is no writable filesystem
OAuth token	quick local use with your own account
IAM token	short-lived, mostly for testing — it expires within 12 hours

Or nothing at all. Running on a Yandex Cloud VM with an attached service account, the instance metadata service issues tokens and already knows the folder. Choose that mode and there is nothing to type or store.

Permissions

Grant the service account viewer on the folder. OpenSRE only reads: the client sends GET and nothing else, and every mutating Yandex Cloud API uses a different verb.

Connect

opensre integrations setup yandex_cloud

The wizard asks how to authenticate, then for the folder and the credential. On a Yandex Cloud VM the folder and cloud ids are filled in from the instance, so pressing enter accepts them.

Check it:

opensre integrations verify yandex_cloud

A working connection reports the folder name and how many service endpoints answered.

Environment variables

Setting these connects the integration without running the wizard — useful in a container or CI job. Supply YC_FOLDER_ID plus exactly one credential.

Variable	Meaning
YC_FOLDER_ID	folder to read; required unless YC_USE_METADATA is set
YC_CLOUD_ID	only needed by the APIs that list folders
YC_SA_KEY_FILE	path to an authorized key JSON file
YC_SA_KEY	the same key inline
YC_TOKEN	OAuth token
YC_IAM_TOKEN	ready IAM token
YC_USE_METADATA	true on a Yandex Cloud VM with an attached service account

The names match the ones the yc CLI already reads, so a shell that can run yc can run OpenSRE without a second set of exports.

Troubleshooting

“Yandex Cloud needs a folder_id”. The folder is missing and the credential is not the metadata service. Set YC_FOLDER_ID, or choose the instance metadata mode when running on a VM.

Verification fails with a permission error. The service account has no viewer on that folder — check that the role was granted on the folder you configured, not on a different one.

”… is not a documented read of …”. The generic reader only sends paths the endpoint index lists, which is what keeps it to reads. A path that is not in the index is refused before any request goes out, even when it looks right. Ask for the path instead of typing one:

find_yc_api "security groups"

The key file cannot be read. YC_SA_KEY_FILE must point at the authorized key JSON produced by yc iam key create, readable by the user running OpenSRE.