Yandex Cloud

Status: available · package wg-flow-plugin-yandex 0.1.0 · provider yandex · category cloud.

The plugin reads one Yandex Cloud folder. Inventory receives virtual machines, disks, VPC networks, reserved public IPs, security groups, and load balancers. The secret stays in the agent YAML.

Compute and VPC do not accept an API key. The agent obtains an IAM token and calls the APIs with Authorization: Bearer. For a service account it signs a JWT with the authorized key JSON (yc iam key create) and refreshes the IAM token while that key is valid. An OAuth token is exchanged the same way. A ready IAM token (t1.) is accepted, but it lasts about 12 hours and is not refreshed.

One source is one folder. The folder id is in the console URL. The service account, or the user behind the OAuth token, needs the viewer role on that folder.

The plugin only reads the API.

Images, snapshots, instance groups, filesystems, Managed Kubernetes, managed databases, Object Storage, Certificate Manager, Cloud DNS, Lockbox, and KMS are not read in 0.1.0. Instance metadata (SSH keys, user-data) is not copied into inventory. A 403 or 404 from a load balancer API yields an empty list and does not fail the source. Any other list error fails the whole source, so a partial snapshot is not sent.

Install

The agent must be connected to the API.

docker compose exec agent wg-flow-agent plugin install yandex
# or
wg-flow-agent plugin install yandex

Then the local UI → Connections → yandex, or YAML.

Service account key:

yc iam key create --service-account-id <id> --output key.json

An OAuth token for a Yandex user is described in the Yandex Cloud docs. The CLI flow opens https://oauth.yandex.ru/authorize?response_type=token&client_id=1a6990aa636648e9b2ef855fa7bec2fb — the token is in the redirect URL.

What lands in inventory

Yandex Cloud object	resource_type	Notes
Virtual machine	instance	provider_resource_id = instance:{id}. RUNNING → active, STOPPED → stopped, transitional states and DELETING → pending, ERROR and CRASHED → error. Region is the zone (ru-central1-a). Public IPv4 from one-to-one NAT → metadata.primary_ipv4, internal addresses → metadata.private_ips. vCPU, memory, and core fraction are cpu_cores, mem_gb, core_fraction. When disks are collected in the same run, the boot disk size is disk_gb
Disk	storage	disk:{id}. READY → active, CREATING → pending. Size in metadata.disk_gb and metadata.size_gb. Type is disk_type
Network	network	network:{id}. Subnet CIDRs from this folder in metadata.ip_ranges
Subnet of another network	network	subnet:{id}, metadata.product = subnet. This keeps the address plan when the network lives in another folder
Public IP	network	address:{id}. metadata.product = public_ip. Address in metadata.primary_ipv4
Security group	firewall	firewall:{id}. Metadata stores the rule count, not the rules
Network load balancer	load_balancer	nlb:{id}. ACTIVE → active, STOPPED and INACTIVE → stopped
Application load balancer	load_balancer	alb:{id}. Same statuses

Inventory has no separate ip type, so a public address is a network.

Each collect flag can be turned off. A disabled slice is not requested and is absent from the next successful sync, and inventory marks those rows inactive. An instance gets disk_gb only when disk collection is on.

Several folders mean several sources. provider_account is your label.

YAML

plugins:
  yandex:
    enabled: true
    sources:
      - id: prod
        provider_account: "yc-prod"
        sync_interval_seconds: 300
        folder_id: "b1g…"
        auth_type: "authorized_key"
        authorized_key: "{\"id\":\"aje…\",\"service_account_id\":\"aje…\",\"private_key\":\"-----BEGIN PRIVATE KEY-----\\n…\"}"
        collect_instances: true
        collect_disks: true
        collect_networks: true
        collect_addresses: true
        collect_firewalls: true
        collect_load_balancers: true

OAuth instead of a key: auth_type: oauth and a token. An IAM token t1. uses the same field.

Source fields

Field	Required	Description
id	yes	Log key (yandex/prod)
provider_account	yes	Folder label in inventory
folder_id	yes	Folder id
auth_type	no	oauth (default) or authorized_key
token	for oauth	OAuth token or IAM t1.
authorized_key	for a key	The whole authorized key JSON
collect_*	no	Default true
sync_interval_seconds	no	Minimum 300

Check

wg-flow-agent status
wg-flow-agent dry-run

JSON shows provider: yandex. Health obtains an IAM token and lists instances with pageSize=1. The key and token are not written to inventory.

Common errors

Symptom	What to check
401	The OAuth token is still valid, or the key JSON has id, service_account_id, and private_key. An API key does not work here
403 on the folder	The account has viewer on this folder_id
IAM token expired	t1. is not refreshed. Use OAuth or an authorized key
Empty instance list	collect_instances is on and the VMs are in this folder
No disk_gb on a VM	collect_disks is off, so the disk size was not requested
No load balancers	Missing NLB or ALB permission — the source still succeeds
Disks disappeared after sync	collect_disks was turned off; inventory retires the missing rows