Skip to main content
OpenSRE reads a Yandex Cloud folder to investigate incidents in it. This page covers connecting the account; the tools that read metrics, logs and resources arrive in follow-up releases.

​
What you need

A folder ID. Every Yandex Cloud read is folder-scoped — the Monitoring API rejects cross-folder queries outright — so nothing works without it. Take it from the console URL, or run:
One credential. Four kinds work, in the order you would normally reach for them: Or nothing at all. Running on a Yandex Cloud VM with an attached service account, the instance metadata service issues tokens and already knows the folder. Choose that mode and there is nothing to type or store.

​
Permissions

Grant the service account viewer on the folder. OpenSRE only reads: the client sends GET and nothing else, and every mutating Yandex Cloud API uses a different verb.

​
Connect

The wizard asks how to authenticate, then for the folder and the credential. On a Yandex Cloud VM the folder and cloud ids are filled in from the instance, so pressing enter accepts them. Check it:
A working connection reports the folder name and how many service endpoints answered.

​
Environment variables

Setting these connects the integration without running the wizard — useful in a container or CI job. Supply YC_FOLDER_ID plus exactly one credential. The names match the ones the yc CLI already reads, so a shell that can run yc can run OpenSRE without a second set of exports.

​
Troubleshooting

“Yandex Cloud needs a folder_id”. The folder is missing and the credential is not the metadata service. Set YC_FOLDER_ID, or choose the instance metadata mode when running on a VM. Verification fails with a permission error. The service account has no viewer on that folder — check that the role was granted on the folder you configured, not on a different one. The key file cannot be read. YC_SA_KEY_FILE must point at the authorized key JSON produced by yc iam key create, readable by the user running OpenSRE.