Yandex Cloud CLI (yc)

Overview

The yc CLI is the primary tool for managing all Yandex Cloud resources. This skill covers installation, authentication, and all major service groups. Object Storage also supports S3-compatible commands via yc storage s3 and yc storage s3api.

Preflight

Before any operation, check if yc is installed and authenticated:

# Check installation (default install path on macOS/Linux)
which yc || ls ~/yandex-cloud/bin/yc
yc version

# Check current config
yc config list

If yc is not found via which but exists at ~/yandex-cloud/bin/yc, the PATH needs updating:

export PATH="$HOME/yandex-cloud/bin:$PATH"

If yc is not installed at all, guide the user through installation (see Installation section). If yc config list shows no token/cloud/folder, guide through yc init.

Installation

macOS / Linux:

curl -sSL https://storage.yandexcloud.net/yandexcloud-yc/install.sh | bash

Restart the terminal after installation. The script updates PATH automatically.

Verify:

yc version

Authentication

Interactive (recommended for personal use)

yc init

This walks through:

1. Get OAuth token from the URL it provides
2. Select cloud
3. Select default folder
4. Optionally set default availability zone

Service Account (for automation)

# Create service account
yc iam service-account create --name my-sa

# Assign role
yc resource-manager folder add-access-binding <folder-id> \
  --role editor \
  --subject serviceAccount:<sa-id>

# Create authorized key
yc iam key create --service-account-name my-sa --output sa-key.json

# Create a profile using the key
yc config profile create my-sa-profile
yc config set service-account-key sa-key.json

Federated login (SSO)

yc init --federation-id=<federation-id>

Check current identity

yc config list
yc iam whoami

Object Storage (Buckets & Files)

Create a bucket

yc storage bucket create --name my-bucket
yc storage bucket create --name my-bucket --default-storage-class cold

List / inspect buckets

yc storage bucket list
yc storage bucket get --name my-bucket
yc storage bucket stats --name my-bucket

Upload files

# Single file
yc storage s3api put-object --bucket my-bucket --key path/to/file.html --body ./local-file.html

# Copy (supports local->s3, s3->local, s3->s3)
yc storage s3 cp ./local-file.txt s3://my-bucket/remote-file.txt
yc storage s3 cp --recursive ./my-site/ s3://my-bucket/

# Move
yc storage s3 mv ./file.txt s3://my-bucket/file.txt

Download files

yc storage s3api get-object --bucket my-bucket --key file.txt ./downloaded.txt
yc storage s3 cp s3://my-bucket/file.txt ./local-file.txt

Delete files

yc storage s3api delete-object --bucket my-bucket --key file.txt
yc storage s3 rm s3://my-bucket/file.txt
yc storage s3 rm --recursive s3://my-bucket/prefix/

List objects

yc storage s3api list-objects --bucket my-bucket
yc storage s3api list-objects --bucket my-bucket --prefix "images/"

Presigned URLs

yc storage s3 presign s3://my-bucket/file.txt

ACLs

yc storage s3api get-object-acl --bucket my-bucket --key file.txt
yc storage s3api put-object-acl --bucket my-bucket --key file.txt --acl public-read

Tagging

yc storage s3api put-object-tagging --bucket my-bucket --key file.txt \
  --tagging '{"TagSet": [{"Key": "env", "Value": "prod"}]}'
yc storage s3api get-object-tagging --bucket my-bucket --key file.txt

Delete bucket

yc storage bucket delete --name my-bucket

Static Website Hosting

1. Create bucket (name = your domain or any name)

yc storage bucket create --name my-website

2. Upload site files

yc storage s3 cp --recursive ./my-site/ s3://my-website/

3. Enable hosting

Create hosting.json:

{
  "index": "index.html",
  "error": "error404.html"
}

yc storage bucket update --name my-website --website-settings-from-file hosting.json

4. Make bucket public

yc storage bucket update --name my-website \
  --public-read \
  --public-list

5. Verify

yc storage bucket get --full --name my-website

The site is available at: http://my-website.website.yandexcloud.net

For a custom domain, create a CNAME DNS record pointing to my-website.website.yandexcloud.net.

HTTPS for custom domain

# Add certificate via Certificate Manager
yc certificate-manager certificate request --name my-cert \
  --domains example.com

# Attach to bucket
yc storage bucket set-https --name my-website \
  --certificate-id <certificate-id>

Billing

There is no yc billing command group. Billing is managed via the Yandex Cloud console only.

• View costs & usage: https://console.yandex.cloud/billing
• Billing API (REST): https://billing.api.cloud.yandex.net/billing/v1/billingAccounts

You can set up a serverless trigger to react to billing budget thresholds:

yc serverless trigger create billing-budget \
  --name my-trigger \
  --billing-account-id <account-id> \
  --budget-id <budget-id> \
  --invoke-function-id <function-id>

Compute (VMs)

# List VMs
yc compute instance list

# Create VM
yc compute instance create \
  --name my-vm \
  --zone ru-central1-a \
  --cores 2 --memory 4GB \
  --core-fraction 100 \
  --create-boot-disk image-folder-id=standard-images,image-family=ubuntu-2204-lts,size=20 \
  --network-interface subnet-name=default-ru-central1-a,nat-ip-version=ipv4 \
  --ssh-key ~/.ssh/id_rsa.pub

# Get VM info
yc compute instance get my-vm

# Start / stop / restart
yc compute instance start my-vm
yc compute instance stop my-vm
yc compute instance restart my-vm

# Delete VM
yc compute instance delete my-vm

# List available images
yc compute image list --folder-id standard-images

# Disks
yc compute disk list
yc compute disk create --name my-disk --size 50 --zone ru-central1-a
yc compute disk delete my-disk

# Snapshots
yc compute snapshot create --name my-snap --disk-name my-disk
yc compute snapshot list

Serverless Functions (Cloud Functions)

Create and manage functions

# Create function
yc serverless function create --name my-function

# List functions
yc serverless function list

# Get function info
yc serverless function get --name my-function

# Delete function
yc serverless function delete --name my-function

Deploy a version

# From Object Storage package
yc serverless function version create \
  --function-name my-function \
  --runtime python312 \
  --entrypoint handler.handler \
  --memory 128m \
  --execution-timeout 10s \
  --package-bucket-name my-bucket \
  --package-object-name deploy/function.zip \
  --environment "KEY1=val1,KEY2=val2" \
  --service-account-id <sa-id>

# Available runtimes
# python312, python311, nodejs18, nodejs16, golang121, java21, dotnet8, bash-2204, r-43

Packaging for deployment

# Python example: install deps + zip
pip3 install -t package httpx boto3
cp *.py package/
cd package && zip -qr ../function.zip . && cd ..
rm -rf package

# Upload package
yc storage s3 cp function.zip s3://my-bucket/deploy/function.zip

Public access and invocation

# Make function publicly accessible (no auth required)
yc serverless function allow-unauthenticated-invoke --name my-function

# Revoke public access
yc serverless function deny-unauthenticated-invoke --name my-function

# Invoke directly (for testing)
yc serverless function invoke --name my-function --data '{"key": "value"}'

# Get function URL
# https://functions.yandexcloud.net/<function-id>

Logs and monitoring

# View function logs
yc log read --group-name <function-name> --follow

# List function versions
yc serverless function version list --function-name my-function

Triggers

# Create timer trigger (cron)
yc serverless trigger create timer \
  --name my-timer \
  --cron-expression "*/5 * * * ? *" \
  --invoke-function-name my-function \
  --invoke-function-service-account-id <sa-id>

# Create Object Storage trigger (on upload)
yc serverless trigger create object-storage \
  --name my-trigger \
  --bucket-id my-bucket \
  --events create-object \
  --invoke-function-name my-function \
  --invoke-function-service-account-id <sa-id>

# List triggers
yc serverless trigger list

# Delete trigger
yc serverless trigger delete --name my-trigger

Telegram bot webhook pattern

# 1. Create & deploy function (see above)
# 2. Make publicly accessible
yc serverless function allow-unauthenticated-invoke --name my-bot

# 3. Set Telegram webhook
curl -X POST "https://api.telegram.org/bot<TOKEN>/setWebhook" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://functions.yandexcloud.net/<function-id>", "secret_token": "<webhook-secret>"}'

# 4. Verify webhook
curl -s "https://api.telegram.org/bot<TOKEN>/getWebhookInfo" | python3 -m json.tool

# Note: allow-unauthenticated-invoke eliminates the need for API Gateway.
# The function URL is directly reachable via HTTPS.

All Major Service Groups

For comprehensive reference on any service group below, run yc <group> --help. See references/service-groups.md for the full command reference.

Group	Description
compute	VMs, disks, images, snapshots, instance groups
storage	Object Storage buckets, S3 operations
vpc	Networks, subnets, security groups, routing
iam	Users, service accounts, roles, keys, tokens
resource-manager	Clouds, folders
certificate-manager	TLS certificates
dns	DNS zones and records
managed-postgresql	Managed PostgreSQL clusters
managed-mysql	Managed MySQL clusters
managed-clickhouse	Managed ClickHouse clusters
managed-mongodb	Managed MongoDB clusters
managed-redis	Managed Redis clusters
managed-kafka	Managed Kafka clusters
managed-kubernetes	Kubernetes clusters and node groups
serverless	Functions, triggers, containers, API gateways
container	Container Registry
ydb	YDB databases
kms	Key Management Service
logging	Cloud Logging
cdn	CDN resources
application-load-balancer	L7 load balancers
load-balancer	Network load balancers
organization-manager	Organizations, federations
dataproc	Data Processing clusters
datatransfer	Data Transfer
lockbox	Secret management
backup	Cloud Backup
audit-trails	Audit Trails
smartcaptcha	SmartCaptcha
baremetal	Bare Metal servers
managed-gitlab	Managed GitLab
quota-manager	Quota management

Common Patterns

Set default folder (avoids --folder-id everywhere)

yc config set folder-id <folder-id>

Output as JSON (for scripting)

yc compute instance list --format json
yc storage bucket list --format json

Switch profiles

yc config profile list
yc config profile activate <profile-name>

Get IDs programmatically

INSTANCE_ID=$(yc compute instance get my-vm --format json | jq -r '.id')

Troubleshooting

Issue	Fix
yc: command not found	Restart terminal or source ~/.bashrc / source ~/.zshrc
unauthenticated	Run yc init or check yc config list
permission denied	Check IAM roles: yc resource-manager folder list-access-bindings <folder-id>
quota exceeded	Check quotas in console or request increase
Wrong cloud/folder	yc config set cloud-id <id> / yc config set folder-id <id>