> ## Documentation Index
> Fetch the complete documentation index at: https://opensre.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Yandex Cloud

> Connect OpenSRE to a Yandex Cloud folder

OpenSRE reads a Yandex Cloud folder to investigate incidents in it. This page
covers connecting the account and what OpenSRE can read once connected.

## What OpenSRE reads

Once the folder is connected, an investigation can reach:

| Area            | What it answers                                                                                                                                       |
| --------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
| Monitoring      | metric series for a query, and which metric names and labels exist                                                                                    |
| Cloud Logging   | log entries in a group, filtered by level and time, and which groups exist                                                                            |
| Compute         | which instances exist and which are stopped, plus serial console output                                                                               |
| Load balancers  | which network or application balancer targets are unhealthy                                                                                           |
| Everything else | any readable resource — container registry, DNS, KMS, Lockbox, YDB, certificates and the rest — looked up by name and read through the generic reader |

The last row matters more than it looks: OpenSRE ships an index of every read
endpoint the Yandex Cloud API exposes, so a service without a dedicated tool is
still reachable. Audit Trails is in that index, so trails and their settings are
readable now; the audit *events* are not, because Yandex delivers them to a sink
rather than through the API.

**Reading log entries needs one extra package.** Cloud Logging is the only
Yandex Cloud read with no REST endpoint, so it uses Yandex's gRPC stubs:

```bash theme={null}
pip install 'opensre[yandex_cloud_logs]'
```

Everything else — including listing log groups — works without it. Log entries
are kept for at most 31 days, and reads are limited to five per second.

OpenSRE never changes anything in your cloud. When an investigation concludes
that something needs doing, it reports the exact `yc` command for you to run.

## What you need

**A folder ID.** Every Yandex Cloud read is folder-scoped — the Monitoring API
rejects cross-folder queries outright — so nothing works without it. Take it
from the console URL, or run:

```bash theme={null}
yc config get folder-id
```

**One credential.** Four kinds work, in the order you would normally reach for
them:

| Credential                  | Use it when                                                  |
| --------------------------- | ------------------------------------------------------------ |
| Service-account key file    | the normal choice for anything unattended                    |
| Service-account key, inline | same, where there is no writable filesystem                  |
| OAuth token                 | quick local use with your own account                        |
| IAM token                   | short-lived, mostly for testing — it expires within 12 hours |

**Or nothing at all.** Running on a Yandex Cloud VM with an attached service
account, the instance metadata service issues tokens and already knows the
folder. Choose that mode and there is nothing to type or store.

## Permissions

Grant the service account **`viewer`** on the folder. OpenSRE only reads: the
client sends `GET` and nothing else, and every mutating Yandex Cloud API uses a
different verb.

## Connect

```bash theme={null}
opensre integrations setup yandex_cloud
```

The wizard asks how to authenticate, then for the folder and the credential.
On a Yandex Cloud VM the folder and cloud ids are filled in from the instance,
so pressing enter accepts them.

Check it:

```bash theme={null}
opensre integrations verify yandex_cloud
```

A working connection reports the folder name and how many service endpoints
answered.

## Environment variables

Setting these connects the integration without running the wizard — useful in a
container or CI job. Supply `YC_FOLDER_ID` plus exactly one credential.

| Variable          | Meaning                                                      |
| ----------------- | ------------------------------------------------------------ |
| `YC_FOLDER_ID`    | folder to read; required unless `YC_USE_METADATA` is set     |
| `YC_CLOUD_ID`     | only needed by the APIs that list folders                    |
| `YC_SA_KEY_FILE`  | path to an authorized key JSON file                          |
| `YC_SA_KEY`       | the same key inline                                          |
| `YC_TOKEN`        | OAuth token                                                  |
| `YC_IAM_TOKEN`    | ready IAM token                                              |
| `YC_USE_METADATA` | `true` on a Yandex Cloud VM with an attached service account |

The names match the ones the `yc` CLI already reads, so a shell that can run
`yc` can run OpenSRE without a second set of exports.

## Troubleshooting

**"Yandex Cloud needs a folder\_id".** The folder is missing and the credential
is not the metadata service. Set `YC_FOLDER_ID`, or choose the instance
metadata mode when running on a VM.

**Verification fails with a permission error.** The service account has no
`viewer` on that folder — check that the role was granted on the folder you
configured, not on a different one.

**"... is not a documented read of ...".** The generic reader only sends paths the
endpoint index lists, which is what keeps it to reads. A path that is not in the
index is refused before any request goes out, even when it looks right. Ask for
the path instead of typing one:

```
find_yc_api "security groups"
```

**The key file cannot be read.** `YC_SA_KEY_FILE` must point at the authorized
key JSON produced by `yc iam key create`, readable by the user running OpenSRE.