Attach custom policy to a RAM user - Container Registry - Alibaba Cloud Documentation Center

This topic shows how to create a custom policy that grants read and write permissions for a specific namespace in a Container Registry Enterprise Edition instance.

Create a custom policy

Log on to the RAM console as a RAM administrator.
In the navigation pane on the left, choose Permissions > Policies.
On the Policies page, click Create Policy.
On the Create Policy page, click the JSON tab.

Copy the following policy content into the editor and replace the instanceid and namespace placeholders with your values.

To grant additional permissions, see Authentication rules of Container Registry for the supported Action and Resource formats. For details about policy syntax, see policy structure and syntax.

Note

The asterisk (*) acts as a wildcard. For example, cr:ListInstance* grants all actions that start with cr:ListInstance. If you set acs:cr:*:*:repository/$instanceid/$namespace/* to acs:cr:*:*:repository/cri-123456/ns/*, the policy grants all permissions on the ns namespace in instance cri-123456 across all regions.

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cr:ListInstance*",
        "cr:GetInstance*",
        "cr:ListSignature*"
      ],
      "Resource": "*"
    },
    {
      "Action": [
        "cr:*"
      ],
      "Effect": "Allow",
      "Resource": [
        "acs:cr:*:*:repository/$instanceid/$namespace/*",
        "acs:cr:*:*:repository/$instanceid/$namespace"
      ]
    },
    {
      "Action": [
        "cr:List*"
      ],
      "Effect": "Allow",
      "Resource": [
        "acs:cr:*:*:repository/$instanceid/*",
        "acs:cr:*:*:repository/$instanceid/*/*"
      ]
    }
  ],
  "Version": "1"
}

Click Confirm. In the Create Policy dialog box, enter a Policy Name and Description.

Attach the custom policy

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Users.
On the Users page, find the required RAM user, and click Add Permissions in the Actions column.

You can also select multiple RAM users and click Add Permissions in the lower part of the page to grant permissions to the RAM users at a time.
In the Grant Permission panel, grant permissions to the RAM user.
1. Configure the Resource Scope parameter.
  - Account: The authorization takes effect on the current Alibaba Cloud account.
  - Resource Group: The authorization takes effect on a specific resource group.
    
    Important
    If you select Resource Group for the Resource Scope parameter, make sure that the required cloud service supports resource groups. For more information, see Services that work with Resource Group. For more information about how to grant permissions on a resource group, see Use resource groups to manage ECS access.
2. Configure the Principal parameter.
  
  The principal is the RAM user to which you want to grant permissions. The current RAM user is automatically selected.
3. Configure the Policy parameter.
  
  A policy contains a set of permissions. Policies can be classified into system policies and custom policies. You can select multiple policies at a time.
  - System policies: policies that are created by Alibaba Cloud. You can use but cannot modify these policies. Version updates of the policies are maintained by Alibaba Cloud. For more information, see Services that work with RAM.
    
    Note
    The system automatically identifies high-risk system policies, such as AdministratorAccess and AliyunRAMFullAccess. We recommend that you do not grant unnecessary permissions by attaching high-risk policies.
  - Custom policies: You can manage and update custom policies based on your business requirements. You can create, update, and delete custom policies. For more information, see Create a custom policy.
4. Click OK.
Click Close.

Note

After logging on to the Container Registry console, the RAM user can build, push, and pull images in the authorized namespace.