Repository access control

Background information

RAM notes

When you use RAM to grant permissions to a RAM user, note the following to avoid granting excessive permissions.

Grant a system policy to a RAM user

This section describes how to grant the AliyunContainerRegistryReadOnlyAccess policy to a RAM user.

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, find the RAM user and click Actions in the Attach Policy column.

   Alternatively, you can select multiple RAM users and click Attach Policy at the bottom of the list to grant permissions to them all at once.

4. Authorize

   1. Select an authorization scope.

      • Account: The permissions apply within the current Alibaba Cloud account.

      • resource: The permissions apply within the specified resource group.

        Note

        To grant permissions at the resource group level, the cloud service must support resource groups. For more information, see Services that support resource groups.

   2. Specify the principal.

      The principal is the user who will receive the permissions. The RAM user you selected is automatically specified as the principal.

   3. In the Policies search box, search for AliyunContainerRegistryReadOnlyAccess, and then click AliyunContainerRegistryReadOnlyAccess in the results list.

   4. Click OK.

5. Click Off.

Grant a custom policy to a RAM user

For more fine-grained access control, you can create a custom policy and grant it to a RAM user.

Policy examples for common scenarios

The following examples show custom policies for common scenarios:

• Scenario 1: Grant a RAM user read-only permissions on a specific namespace, for example, juzhong.

  After the RAM user logs on to the instance, they can pull all images from this namespace and use the API to view information about the namespace and its repositories.

  {
    "Statement": [
      {
        "Action": [
          "cr:Get*",
          "cr:List*",
          "cr:PullRepository"
        ],
        "Effect": "Allow",
        "Resource": [
          "acs:cr:*:*:repository/juzhong/*"
        ]
      }
    ],
    "Version": "1"
  }
                      

  Important

  If the RAM user also needs to view the namespace in the console, you must grant an additional permission. The following policy allows the user to view all namespaces and repositories, but they can only pull images from the juzhong namespace.

  {
    "Statement": [
      {
        "Action": [
          "cr:Get*",
          "cr:List*",
          "cr:PullRepository"
        ],
        "Effect": "Allow",
        "Resource": [
          "acs:cr:*:*:repository/juzhong/*"
        ]
      },
      {
        "Action": [
          "cr:ListNamespace",
          "cr:ListRepository"
        ],
        "Effect": "Allow",
        "Resource": [
          "*"
        ]
      }
    ],
    "Version": "1"
  }
                      

• Scenario 2: Grant a RAM user all permissions on a specific image repository. For example, the repository is named nginx in the juzhong namespace in the China (Hangzhou) region.

  Important

  To allow the RAM user to manage the image repository from the console, you must also add the console access permissions described in Scenario 1.

  {
    "Statement": [
      {
        "Action": [
          "cr:*"
        ],
        "Effect": "Allow",
        "Resource": [
          "acs:cr:cn-hangzhou:*:repository/juzhong/nginx"
        ]
      },
      {
        "Action": [
          "cr:Get*",
          "cr:List*"
        ],
        "Effect": "Allow",
        "Resource": [
          "acs:cr:*:*:repository/juzhong"
        ]
      }
    ],
    "Version": "1"
  }
                      

• Scenario 3: Grant a RAM user all permissions for a specific namespace.

  Important

  This scenario is for API access only. To allow the user to view all repositories in the console, refer to the configuration in Scenario 1.

  {
      "Statement": [
          {
              "Action": [
                  "cr:*"
              ],
              "Effect": "Allow",
              "Resource": [
                  "acs:cr:cn-hangzhou:*:repository/juzhong",
                  "acs:cr:cn-hangzhou:*:repository/juzhong/*"
              ]
          }
      ],
      "Version": "1"
  }

You can use the policy examples from the preceding scenarios to create and grant a custom policy. Follow these steps:

1. Create a custom policy.

   1. Log on to the RAM console with your Alibaba Cloud account.

   2. In the left-side navigation pane, choose Permissions > Policies.

   3. On the Policies page, click Create Policy.

   4. On the Create Policy page, click the JSON Editor tab and enter the policy document in the editor. For more information about the policy syntax, see Policy structure and syntax.

      Note

      When editing the policy, refer to Authentication rules for Container Registry for the correct Action and Resource configurations.

   5. Click Confirm. Then, in the Create Policy dialog box, enter a Policy Name and a Notes.

2. Grant the custom policy to a RAM user.

   1. Log on to the RAM console with your Alibaba Cloud account.

   2. In the left-side navigation pane, choose Identities > Users.

   3. On the User page, find the target RAM user and click Add Permission in the Actions column.

   4. In the Authorize panel, grant permissions to the RAM user.

      1. Select an authorization scope.

         • Account: The permissions take effect within the current Alibaba Cloud account.

         • resource: The permissions take effect only within the specified resource group.

           Note

           To grant permissions on a resource group, make sure that the cloud service supports resource groups. For more information, see Services that work with Resource Group.

      2. Specify the Principal.

         The principal is the RAM user who will receive the permissions. The current RAM user is automatically selected. You can also add other RAM users.

      3. In the All Types section, click Custom Policy. Enter the name of the policy that you created in the search box, and then click the policy name from the results.

      4. Click OK.

   5. Click Off.

Authentication rules

Resource ARN format

When you grant permissions by using RAM, you must specify the resources in the following format:

The following table describes the parameters in the resource ARN.