Halaman ini mencantumkan format Nama Sumber Daya Alibaba Cloud (ARN) serta pemetaan operasi API ke aksi untuk Container Registry (ACR). Gunakan halaman ini untuk menemukan nilai Action dan Resource yang tepat saat menyusun pernyataan kebijakan Resource Access Management (RAM).
Format ARN
Tabel berikut mencantumkan format ARN untuk setiap jenis resource. Gunakan ARN tersebut dalam elemen Resource pada pernyataan kebijakan.
| Tipe resource | Format ARN |
|---|
| Semua resource | acs:cr:$regionid:$accountid:* |
| Instans | acs:cr:$regionid:$accountid:instance/$instanceid |
| Repository (semua dalam instans) | acs:cr:$regionid:$accountid:repository/$instanceid/* |
| Repository (cakupan instans) | acs:cr:$regionid:$accountid:repository/$instanceid |
| Repository (semua dalam namespace) | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/* |
| Repository (spesifik) | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname |
| Namespace | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename |
| Namespace chart (semua dalam instans) | acs:cr:$regionid:$accountid:chart/$instanceid/* |
| Namespace chart (cakupan instans) | acs:cr:$regionid:$accountid:chart/$instanceid |
| Repository chart (semua dalam namespace) | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/* |
| Namespace chart (spesifik) | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename |
| Repository chart (spesifik) | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname |
Parameter ARN
| Parameter | Deskripsi |
|---|
$regionid | ID Wilayah. Ganti dengan * untuk mencocokkan semua wilayah. |
$accountid | ID akun Alibaba Cloud. Ganti dengan * untuk mencocokkan semua akun. |
$instanceid | ID instans Container Registry Edisi Perusahaan. |
$namespacename | Nama namespace. |
$repositoryname | Nama repository image. |
$chartnamespacename | Nama namespace chart. |
$chartrepositoryname | Nama repository chart. |
Aturan autentikasi API
Saat pengguna RAM atau pemanggil Security Token Service (STS) memanggil API Container Registry, ACR memverifikasi apakah pemanggil memiliki izin yang diperlukan. Tabel berikut memetakan setiap operasi API ke aksi dan cakupan resource yang sesuai.
Kolom-kolomnya adalah:
API: Nama operasi API.
Action: String izin yang harus disertakan dalam elemen Action pada pernyataan kebijakan Anda.
Resource: Pola ARN untuk elemen Resource. * berarti aksi tersebut tidak berada pada level resource dan memerlukan "Resource": "*".
Tingkat akses: Menunjukkan apakah aksi tersebut bersifat membaca data (Read), mencantumkan resource (List), mengubah resource (Write), atau mengelola izin (Permissions management).
Catatan Catatan: * digunakan sebagai wildcard baik dalam pola ARN maupun kolom Resource.
Instance
| API | Action | Resource | Tingkat akses |
|---|
| GetInstance | cr:GetInstance | acs:cr:$regionid:$accountid:instance/$instanceid | Read |
| GetInstanceCount | cr:ListInstance | * | List |
| GetInstanceEndpoint | cr:GetInstanceEndpoint | acs:cr:$regionid:$accountid:instance/$instanceid | Read |
| GetInstanceUsage | cr:GetInstanceUsage | acs:cr:$regionid:$accountid:instance/$instanceid | Read |
| GetInstanceVpcEndpoint | cr:GetInstanceVpcEndpoint | acs:cr:$regionid:$accountid:instance/$instanceid | Read |
| ListInstance | cr:ListInstance | * | List |
| ListInstanceEndpoint | cr:ListInstanceEndpoint | acs:cr:$regionid:$accountid:repository/$instanceid | List |
| CreateInstanceEndpointAclPolicy | cr:CreateInstanceEndpointAclPolicy | acs:cr:$regionid:$accountid:instance/$instanceid | Write |
| CreateInstanceVpcEndpointLinkedVpc | cr:CreateInstanceVpcEndpointLinkedVpc | acs:cr:$regionid:$accountid:instance/$instanceid | Write |
| DeleteInstanceEndpointAclPolicy | cr:DeleteInstanceEndpointAclPolicy | acs:cr:$regionid:$accountid:instance/$instanceid | Write |
| DeleteInstanceVpcEndpointLinkedVpc | cr:DeleteInstanceVpcEndpointLinkedVpc | acs:cr:$regionid:$accountid:instance/$instanceid | Write |
| UpdateInstanceEndpointStatus | cr:UpdateInstanceEndpointStatus | acs:cr:$regionid:$accountid:instance/$instanceid | Write |
| GetArtifactBuildRule | cr:GetArtifactBuildRule | acs:cr:$regionid:$accountid:instance/$instanceid | Read |
| GetPersonalInstanceDomainAccessStatus | cr:GetPersonalInstanceDomainAccessStatus | acs:cr:$regionid:$accountid:instance/$instanceid | Read |
| ListRepositoryVulTagCount | cr:ListRepoVulTagCount | acs:cr:$regionid:$accountid:instance/$instanceid | List |
Namespace
| API | Action | Resource | Tingkat akses |
|---|
| GetNamespace | cr:GetNamespace | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename | Read |
| ListNamespace | cr:ListNamespace | acs:cr:$regionid:$accountid:repository/$instanceid/* | List |
| CreateNamespace | cr:CreateNamespace | acs:cr:$regionid:$accountid:repository/$instanceid | Write |
| DeleteNamespace | cr:DeleteNamespace | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename | Write |
| UpdateNamespace | cr:UpdateNamespace | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename | Write |
Repository
| API | Action | Resource | Tingkat akses |
|---|
| GetRepository | cr:GetRepository | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| ListRepository | cr:ListRepository | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/* | List |
| CreateRepository | cr:CreateRepository | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename | Write |
| DeleteRepository | cr:DeleteRepository | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
| UpdateRepository | cr:UpdateRepository | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
Tag dan layer image
| API | Action | Resource | Tingkat akses |
|---|
| GetRepoTagLayers | cr:GetRepositoryLayers | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| GetRepoTagManifest | cr:GetRepositoryManifest | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| ListRepoTag | cr:ListRepositoryTag | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | List |
| DeleteRepoTag | cr:DeleteRepositoryTag | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
Pull, push, dan otorisasi
| API | Action | Resource | Tingkat akses |
|---|
| GetAuthorizationToken | cr:GetAuthorizationToken | * | Read |
| PullRepository | cr:PullRepository | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| PushRepository | cr:PushRepository | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
Build
| API | Action | Resource | Tingkat akses |
|---|
| GetRepoBuildRecord | cr:GetRepositoryBuildRecord | acs:cr:$regionid:$accountid:repository/$instanceid | Read |
| GetRepoBuildRecordStatus | cr:GetBuildRepositoryStatus | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| ListRepoBuildRecord | cr:ListRepositoryBuild | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | List |
| ListRepoBuildRecordLog | cr:GetRepositoryBuildLog | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| ListRepoBuildRule | cr:ListRepositoryBuildRule | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | List |
| CancelRepoBuildRecord | cr:CancelBuildRepository | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
| CreateBuildRecordByRule | cr:BuildRepositoryByRule | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
| CreateRepoBuildRule | cr:CreateRepositoryBuildRule | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
| DeleteRepoBuildRule | cr:DeleteRepositoryBuildRule | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
| UpdateRepoBuildRule | cr:UpdateRepositoryBuildRule | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
Sync
| API | Action | Resource | Tingkat akses |
|---|
| GetRepoSyncTask | cr:GetRepositorySync | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| ListRepoSyncRule | cr:ListSyncRule | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | List |
| ListRepoSyncTask | cr:GetRepositorySync | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | List |
| CreateRepoSyncRule | cr:CreateSyncRule | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
| CreateRepoSyncTaskByRule | cr:CreateRepositorySync | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
| DeleteRepoSyncRule | cr:DeleteSyncRule | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
Trigger (webhook)
| API | Action | Resource | Tingkat akses |
|---|
| ListRepoTrigger | cr:ListWebHook | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | List |
| ListRepoTriggerLog | cr:GetWebHookLog | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| ListRepoTriggerRecord | cr:GetWebHookLog | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| CreateRepoTrigger | cr:CreateWebHook | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
| DeleteRepoTrigger | cr:DeleteWebHook | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
| UpdateRepoTrigger | cr:UpdateWebHook | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
Pemindaian kerentanan
| API | Action | Resource | Tingkat akses |
|---|
| GetRepoTagScanTask | cr:GetScan | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| GetScan | cr:GetScan | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| GetScanStatus | cr:GetScanStatus | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| GetScanCount | cr:GetScanCount | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Read |
| ListScanResult | cr:ListScanResult | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | List |
| PutScan | cr:PutScan | acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname | Write |
Helm charts
| API | Action | Resource | Tingkat akses |
|---|
| GetChartNamespace | cr:GetNamespace | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename | Read |
| GetChartRepository | cr:GetRepository | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname | Read |
| ListChartNamespace | cr:ListNamespace | acs:cr:$regionid:$accountid:chart/$instanceid/* | List |
| ListChartRelease | cr:ListChartRelease | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname | List |
| ListChartRepository | cr:ListRepository | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/* | List |
| CreateChartNamespace | cr:CreateNamespace | acs:cr:$regionid:$accountid:chart/$instanceid | Write |
| DeleteChartNamespace | cr:DeleteNamespace | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename | Write |
| DeleteChartRelease | cr:DeleteChartRelease | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname | Write |
| DeleteChartRepository | cr:DeleteRepository | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname | Write |
| UpdateChartNamespace | cr:UpdateNamespace | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename | Write |
| UpdateChartRepository | cr:UpdateRepository | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname | Write |
| PullChart | cr:PullChart | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname | Read |
| PushChart | cr:PushChart | acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname | Write |