本文将为您介绍在容器镜像服务使用自定义OSS Bucket时的RAM访问控制配置。
背景说明
默认OSS Bucket
当使用容器镜像服务的默认OSS Bucket时,您需为账号授权容器镜像服务访问云服务资源,这样容器镜像服务才能创建OSS Bucket并初始化ACR实例。
自定义OSS Bucket
当您需要使用自定义OSS Bucket,则需要为账号添加RAM角色,并授予该角色对OSS Bucket操作权限,以确保容器镜像服务能够正常访问该Bucket。
步骤一:创建RAM角色
容器镜像服务访问自定义OSS Bucket时,需要为阿里云账号创建的角色名为AliyunContainerRegistryCustomizedOSSBucketRole
。
使用RAM管理员登录RAM控制台。
在左侧导航栏,选择 。
在角色页面,单击创建角色。
在创建角色页面,选择信任主体类型为云服务,然后选择容器镜像服务,最后单击确定。
在角色名称中输入
AliyunContainerRegistryCustomizedOSSBucketRole
,然后单击确定。
步骤二:配置RAM角色的权限策略
配置该RAM角色的策略,使其拥有对指定的OSS Bucket资源读取容器镜像仓库信息的权限,RAM角色的权限策略名为AliyunContainerRegistryCustomizedOSSBucketRolePolicy
。当需要获取多个自定义OSS Bucket信息时,可向Resource中添加多个OSS Bucket值。
{
"Version": "1",
"Statement": [
{
"Action": [
"oss:GetObject",
"oss:PutObject",
"oss:DeleteObject",
"oss:ListParts",
"oss:AbortMultipartUpload",
"oss:InitiateMultipartUpload",
"oss:CompleteMultipartUpload",
"oss:DeleteMultipleObjects",
"oss:ListMultipartUploads",
"oss:ListObjects",
"oss:DeleteObjectVersion",
"oss:GetObjectVersion",
"oss:ListObjectVersions",
"oss:PutObjectTagging",
"oss:GetObjectTagging",
"oss:DeleteObjectTagging"
],
"Resource": [
"acs:oss:*:*:cri-*",
"acs:oss:*:*:cri-*/*",
"acs:oss:*:*:<YOUR_BUCKET_NAME>", # 请将<YOUR_BUCKET_NAME>替换为您实际需要授权的Bucket名称。
"acs:oss:*:*:<YOUR_BUCKET_NAME>/*" # 请将<YOUR_BUCKET_NAME>替换为您实际需要授权的Bucket名称。
],
"Effect": "Allow",
"Condition": {
}
},
{
"Action": [
"oss:PutBucket",
"oss:GetBucket",
"oss:GetBucketLocation",
"oss:PutBucketEncryption",
"oss:GetBucketEncryption",
"oss:PutBucketAcl",
"oss:GetBucketAcl",
"oss:PutBucketLogging",
"oss:GetBucketReferer",
"oss:PutBucketReferer",
"oss:GetBucketLogging",
"oss:PutBucketVersioning",
"oss:GetBucketVersioning",
"oss:GetBucketLifecycle",
"oss:PutBucketLifecycle",
"oss:DeleteBucketLifecycle",
"oss:GetBucketTransferAcceleration"
],
"Resource": [
"acs:oss:*:*:cri-*",
"acs:oss:*:*:cri-*/*",
"acs:oss:*:*:<YOUR_BUCKET_NAME>", # 请将<YOUR_BUCKET_NAME>替换为您实际需要授权的Bucket名称。
"acs:oss:*:*:<YOUR_BUCKET_NAME>/*" # 请将<YOUR_BUCKET_NAME>替换为您实际需要授权的Bucket名称。
],
"Effect": "Allow",
"Condition": {
}
},
{
"Effect": "Allow",
"Action": "oss:ListBuckets",
"Resource": [
"acs:oss:*:*:*",
"acs:oss:*:*:*/*"
],
"Condition": {
}
},
{
"Action": [
"vpc:DescribeVpcs"
],
"Resource": "acs:vpc:*:*:vpc/*",
"Effect": "Allow",
"Condition": {
}
},
{
"Action": [
"cms:QueryMetricLast",
"cms:QueryMetricList"
],
"Resource": "*",
"Effect": "Allow"
}
]
}
该文章对您有帮助吗?