Use GetChain to obtain delivery chain configuration - Container Registry - Alibaba Cloud - Container Registry

Retrieves the definition of a delivery chain to understand the node execution order.

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cr:GetChain

get

*Chain

acs:cr:{#regionId}:{#accountId}:instance/{#InstanceId}/chain/{#ChainId}

None

Request parameters

Parameter	Type	Required	Description	Example
InstanceId	string	Yes	The instance ID.	cri-4cdrlqmhn4gm****
ChainId	string	Yes	The delivery chain ID.	chi-0ops0gsmw5x2****

Response elements

Element	Type	Description	Example
	object
ModifiedTime	integer	The time when the delivery chain description was last modified. The value is a UNIX timestamp in milliseconds.	1638259914000
ScopeId	string	The scope ID of the delivery chain.	crr-nyrh2oko32xb****
RequestId	string	The request ID.	C87993B5-7D61-5CAC-8D64-1AC732DD69FF
Description	string	The description of the delivery chain.	description
CreateTime	integer	The time when the delivery chain was created. The value is a UNIX timestamp in milliseconds.	1638255427000
ScopeType	string	The scope type of the delivery chain.	REPOSITORY
Code	string	The return code.	success
ChainId	string	The delivery chain ID.	chi-0ops0gsmw5x2****
InstanceId	string	The instance ID.	cri-4cdrlqmhn4gm****
IsSuccess	boolean	Indicates whether the request was successful.	true
Name	string	The name of the delivery chain.	test
ChainConfig	object	The configuration of the delivery chain.
ChainConfigId	string	The configuration ID of the delivery chain.	cci-lz3ycgo69ukt****
IsActive	boolean	Indicates whether the delivery chain configuration is active. Valid values: `true`: Active. `false`: Inactive.	true
Version	string	The version of the delivery chain.	1
Routers	array<object>	The execution order between delivery chain nodes.
	array<object>
From	object	The source node.
NodeName	string	The name of the source node.	DOCKER_IMAGE_BUILD
To	object	The destination node.
NodeName	string	The name of the destination node.	DOCKER_IMAGE_PUSH
Nodes	array<object>	The nodes in the delivery chain.
	array<object>
NodeName	string	The name of the delivery chain node.	VULNERABILITY_SCANNING
Enable	boolean	Indicates whether the delivery chain node is enabled. Valid values: `true`: Enabled. `false`: Disabled.	true
NodeConfig	object	The configuration of the delivery chain node.
Timeout	integer	The timeout period, in seconds.	900
Retry	integer	The number of retries.	3
DenyPolicy	object	The blocking policy for the scan node in the delivery chain.
Logic	string	The logic that triggers blocking during scanning.	AND
IssueLevel	string	The vulnerability severity level that triggers blocking.	HIGH
IssueCount	string	The number of vulnerabilities that triggers blocking.	10
Action	string	The blocking action. Valid values: `BLOCK`: Blocks the delivery chain from continuing execution. `BLOCK_RETAG`: Blocks and overwrites the pushed image tag. `BLOCK_DELETE_TAG`: Blocks and deletes the image tag.	BLOCK
IssueList	string	The collection of CVE vulnerabilities to block. Separate multiple CVE vulnerability names with commas (,).	CVE-2020-8286,CVE-2020-8285
MaliciousList	string	The collection of malicious samples to block. Separate multiple malicious sample names with commas (,).	mutate_cockhorse,abnormal_program
BaselineList	string	The collection of baseline samples to block. Separate multiple baseline sample names with commas (,).	identification,hc_image_exploit
ScanEngine	string	The scan engine of the delivery chain scan node. Valid values: `SAS_SCAN_SERVICE`: Security Center scan engine (requires paid activation). `ACR_SCAN_SERVICE`: ACR scan engine.	ACR_SCAN_SERVICE
ScopeExclude	array	The collection of repositories excluded from the delivery chain execution.
	string	The names of repositories excluded from the delivery chain execution. Separate multiple repository names with commas (,).	repo_name1,repo_name2

Examples

Success response

JSON format

{
  "ModifiedTime": 1638259914000,
  "ScopeId": "crr-nyrh2oko32xb****",
  "RequestId": "C87993B5-7D61-5CAC-8D64-1AC732DD69FF",
  "Description": "description",
  "CreateTime": 1638255427000,
  "ScopeType": "REPOSITORY",
  "Code": "success",
  "ChainId": "chi-0ops0gsmw5x2****",
  "InstanceId": "cri-4cdrlqmhn4gm****",
  "IsSuccess": true,
  "Name": "test",
  "ChainConfig": {
    "ChainConfigId": "cci-lz3ycgo69ukt****",
    "IsActive": true,
    "Version": "1",
    "Routers": [
      {
        "From": {
          "NodeName": "DOCKER_IMAGE_BUILD"
        },
        "To": {
          "NodeName": "DOCKER_IMAGE_PUSH"
        }
      }
    ],
    "Nodes": [
      {
        "NodeName": "VULNERABILITY_SCANNING",
        "Enable": true,
        "NodeConfig": {
          "Timeout": 900,
          "Retry": 3,
          "DenyPolicy": {
            "Logic": "AND",
            "IssueLevel": "HIGH",
            "IssueCount": "10",
            "Action": "BLOCK",
            "IssueList": "CVE-2020-8286,CVE-2020-8285",
            "MaliciousList": "mutate_cockhorse,abnormal_program",
            "BaselineList": "identification,hc_image_exploit"
          },
          "ScanEngine": "ACR_SCAN_SERVICE"
        }
      }
    ]
  },
  "ScopeExclude": [
    "repo_name1,repo_name2\n"
  ]
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.