You must grant the AliyunContainerRegistryReadOnlyAccess or AliyunContainerRegistryFullAccess permissions to the service role. For more information, see Configure service permissions.