DocsICP FilingConsole
Documentation
Home Page Container Registry User Guide Permission management Configure RAM Grant a system policy to a RAM user

Grant a system policy to a RAM user

Updated at:
Copy as MD
Product
My Favorites

Alibaba Cloud provides Resource Access Management and Security Token Service (STS) to help you manage permissions with flexibility and security. This topic describes how to grant a system policy to a RAM user.

Prerequisites

A RAM user has been created by using your Alibaba Cloud account. For more information, see Create a RAM user.

Background information

Resource Access Management (RAM) and Security Token Service (STS) provide flexible, secure access control for image repositories. By default, an Alibaba Cloud account has full permissions on the resources it owns. Use RAM and STS to grant different permissions on image resources to different RAM users and to provide temporary access. Before you configure authorization policies, read .

Important

After you configure authorization policies for a RAM user, use that RAM user to log on to the Container Registry console, create a Personal Edition instance, and set a registry password. You can then view the images that the RAM user has permissions on.

Grant permissions to a RAM user

When granting permissions to a RAM user, follow the principle of least privilege to avoid granting excessive permissions.

Important

If you grant a RAM user the AdministratorAccess permission, which includes management permissions on all Alibaba Cloud resources, the RAM user has all permissions on Container Registry, regardless of any previously granted Container Registry permissions.

System policies

Container Registry provides two built-in system policies: AliyunContainerRegistryFullAccess and AliyunContainerRegistryReadOnlyAccess. You can grant them directly to users.

  • AliyunContainerRegistryFullAccess

    A RAM user with this policy has the same permissions on image resources as an Alibaba Cloud account and can perform any operation.

    {
  "Statement": [
    {
      "Action": "cr:*",
      "Effect": "Allow",
      "Resource": "*"
    }
  ],
  "Version": "1"
}

  • AliyunContainerRegistryReadOnlyAccess

    A RAM user with this policy has read-only permissions on all image resources. For example, they can view repository lists and pull images.

    {
  "Statement": [
    {
      "Action": [
        "cr:Get*",
        "cr:List*",
        "cr:Pull*"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ],
  "Version": "1"
}

Procedure

This section describes how to grant the AliyunContainerRegistryReadOnlyAccess policy to a RAM user.

  1. Log on to the RAM console.

  2. In the left-side navigation pane, choose Identities > Users.

  3. On the Users page, find the RAM user and click Actions in the Attach Policy column.

    Alternatively, you can select multiple RAM users and click Attach Policy at the bottom of the list to grant permissions to them all at once.

  4. Authorize

    1. Select an authorization scope.

      • Account: The permissions apply within the current Alibaba Cloud account.

      • resource: The permissions apply within the specified resource group.

        Note

        To grant permissions at the resource group level, the cloud service must support resource groups. For more information, see Services that support resource groups.

    2. Specify the principal.

      The principal is the user who will receive the permissions. The RAM user you selected is automatically specified as the principal.

    3. In the Policies search box, search for AliyunContainerRegistryReadOnlyAccess, and then click AliyunContainerRegistryReadOnlyAccess in the results list.

    4. Click OK.

  5. Click Off.

Related documentation

Previous：Configure RAMNext：Attach custom policy to a RAM user