Container Registry:Repository access control

Background information

Grant permissions to a RAM user

Before you grant permissions to a RAM user, make sure that you do not grant permissions more than necessary to the RAM user.

Attach system policies to a RAM user

In this example, the AliyunContainerRegistryReadOnlyAccess policy is attached to a RAM user.

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the required RAM user, and click Add Permissions in the Actions column.

   

   You can also select multiple RAM users and click Add Permissions in the lower part of the page to grant permissions to the RAM users at a time.

4. In the Grant Permission panel, grant permissions to the RAM user.

   1. Configure the Resource Scope parameter.

      • Account: The permissions take effect on the current Alibaba Cloud account.

      • ResourceGroup: The permissions take effect on a specific resource group.

        Note

        If you select ResourceGroup for the Resource Scope parameter, make sure that the cloud service supports resource groups. For more information, see Services that work with Resource Group.

   2. Specify a principal.

      The principal is the RAM user to which you want to grant permissions. By default, the current RAM user is specified. You can also specify another RAM user.

   3. Click All Types in the Policy section, select Custom Policy from the drop-down list, enter AliyunContainerRegistryReadOnlyAccess in the search box, and then click AliyunContainerRegistryReadOnlyAccess to add the policy to the Selected Policy box.

   4. Click Grant permissions.

5. Click Close.

Attach custom policies to a RAM user

If you want to enforce fine-grained control on permissions, you can create custom policies and attach the custom policies to RAM users.

Policy configurations in typical scenarios

The following part describes how to configure custom policies in typical scenarios:

• Scenario 1: Grant a RAM user the read permission on a namespace. In this example, the namespace is named juzhong.

  After the RAM user logs on to the Container Registry instance, the RAM user can pull all images in the namespace juzhong. The RAM user can view information about the namespace and all repositories in the namespace by calling API operations.

  {
    "Statement": [
      {
        "Action": [
          "cr:Get*",
          "cr:List*",
          "cr:PullRepository"
        ],
        "Effect": "Allow",
        "Resource": [
          "acs:cr:*:*:repository/juzhong/*"
        ]
      }
    ],
    "Version": "1"
  }
                      

  Important

  If you want to allow the RAM user to view all namespaces in the Container Registry console, add the following authorization configurations. Then, the RAM user can view all namespaces and repositories. However, the RAM user can only pull images from repositories in the namespace juzhong.

  {
    "Statement": [
      {
        "Action": [
          "cr:Get*",
          "cr:List*",
          "cr:PullRepository"
        ],
        "Effect": "Allow",
        "Resource": [
          "acs:cr:*:*:repository/juzhong/*"
        ]
      },
      {
        "Action": [
          "cr:ListNamespace",
          "cr:ListRepository"
        ],
        "Effect": "Allow",
        "Resource": [
          "*"
        ]
      }
    ],
    "Version": "1"
  }
                      

• Scenario 2: Grant all permissions on a repository to a RAM user. In this example, the repository is named nginx and is located in the namespace juzhong in the China (Hangzhou) region.

  Important

  If you want to allow the RAM user to manage repositories in the Container Registry console, add relevant configurations by referring to scenario 1.

  {
    "Statement": [
      {
        "Action": [
          "cr:*"
        ],
        "Effect": "Allow",
        "Resource": [
          "acs:cr:cn-hangzhou:*:repository/juzhong/nginx"
        ]
      },
      {
        "Action": [
          "cr:Get*",
          "cr:List*"
        ],
        "Effect": "Allow",
        "Resource": [
          "acs:cr:*:*:repository/juzhong"
        ]
      }
    ],
    "Version": "1"
  }
                      

• Scenario 3: Grant all permissions on a namespace to a RAM user.

  Important

  You can implement the scenario only by calling API operations. If you want to allow the user to view all repositories in the Container Registry console, add relevant configurations by referring to scenario 1.

  {
      "Statement": [
          {
              "Action": [
                  "cr:*"
              ],
              "Effect": "Allow",
              "Resource": [
                  "acs:cr:cn-hangzhou:*:repository/juzhong",
                  "acs:cr:cn-hangzhou:*:repository/juzhong/*"
              ]
          }
      ],
      "Version": "1"
  }

You can create a custom policy by using the scripts introduced in the preceding scenarios and attach the custom policy to the RAM user. To do this, perform the following operations:

1. Create a custom policy.

   1. Log on to the RAM console by using your Alibaba Cloud account.

   2. In the left-side navigation pane, choose Permissions > Policies.

   3. On the Policies page, click Create Policy.

   4. On the Create Policy page, click the JSON tab and edit the policy document in the code editor. For more information about the policy syntax, see Policy structure and syntax.

      Note

      For more information about how to set the Action and Resource parameters when you edit the policy document, see Authentication rules for Container Registry.

   5. Click Next to edit policy information. In the dialog box that appears, set Name and Note.

   6. Click OK.

2. Attach the custom policy to a RAM user

   1. Log on to the RAM console by using your Alibaba Cloud account.

   2. In the left-side navigation pane, choose Identities > Users.

   3. On the Users page, find the RAM user to which you want to attach the custom policy, and click Add Permissions in the Actions column.

   4. In the Grant Permission panel, grant permissions to the RAM user.

      1. Select the authorization scope.

         • Account: The authorization takes effect on the current Alibaba Cloud account.

         • ResourceGroup: The authorization takes effect for a specific resource group.

           Note

           If you select ResourceGroup for the Resource Scope parameter, make sure that the cloud service supports resource groups. For more information, see Services that work with Resource Group.

      2. Specify a principal.

         The principal is the RAM user to which you want to grant permissions. By default, the current RAM user is specified. You can also specify another RAM user.

      3. Click Custom Policy below All Types from the drop-down list, enter a custom policy name in the search box to search for the custom policy, and then click the name of the custom policy.

      4. Click Grant permissions.

   5. Click Close.

Authentication rules of Container Registry

ARN format

The following table describes the Alibaba Cloud Resource Name (ARN) format in an authorization policy when you use RAM to grant permissions to users.

The following table describes the parameters in the ARN format.