RAM authentication rules and resource description - Container Registry: Central de Documentação do Alibaba Cloud

Esta página lista os formatos de Alibaba Cloud Resource Name (ARN) e os mapeamentos de API para ação do Container Registry (ACR). Consulte-a para obter os valores corretos de Action e Resource ao escrever instruções de política do Resource Access Management (RAM).

Formatos de ARN

A tabela a seguir apresenta o formato de ARN para cada tipo de recurso. Use o ARN no elemento Resource da instrução de política.

Tipo de recurso	Formato de ARN
Todos os recursos	`acs:cr:$regionid:$accountid:*`
Instância	`acs:cr:$regionid:$accountid:instance/$instanceid`
Repositório (todos na instância)	`acs:cr:$regionid:$accountid:repository/$instanceid/*`
Repositório (escopo da instância)	`acs:cr:$regionid:$accountid:repository/$instanceid`
Repositório (todos no namespace)	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/*`
Repositório (específico)	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`
Namespace	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename`
Namespace de chart (todos na instância)	`acs:cr:$regionid:$accountid:chart/$instanceid/*`
Namespace de chart (escopo da instância)	`acs:cr:$regionid:$accountid:chart/$instanceid`
Repositório de chart (todos no namespace)	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/*`
Namespace de chart (específico)	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename`
Repositório de chart (específico)	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname`

Parâmetros do ARN

Parâmetro	Descrição
`$regionid`	ID da região. Substitua por `*` para corresponder a todas as regiões.
`$accountid`	ID da conta Alibaba Cloud. Substitua por `*` para corresponder a todas as contas.
`$instanceid`	ID da instância do Container Registry Enterprise Edition.
`$namespacename`	Nome do namespace.
`$repositoryname`	Nome do repositório de imagens.
`$chartnamespacename`	Nome do namespace de chart.
`$chartrepositoryname`	Nome do repositório de chart.

Regras de autenticação da API

Quando um usuário do RAM ou um chamador do Security Token Service (STS) invoca uma API do Container Registry, o ACR verifica se o chamador tem a permissão necessária. A tabela abaixo associa cada operação da API à sua ação obrigatória e ao escopo de recurso correspondente.

As colunas são:

API: nome da operação da API.
Action: string de permissão a incluir no elemento Action da instrução de política.
Resource: padrão de ARN para o elemento Resource. O caractere * indica que a ação não opera no nível de recurso e exige "Resource": "*".
Access level: classifica a ação como leitura de dados (Read), listagem de recursos (List), modificação de recursos (Write) ou gerenciamento de permissões (Permissions management).

Nota

Nota: O caractere * funciona como curinga tanto nos padrões de ARN quanto na coluna Resource.

Instância

API	Action	Resource	Access level
GetInstance	`cr:GetInstance`	`acs:cr:$regionid:$accountid:instance/$instanceid`	Read
GetInstanceCount	`cr:ListInstance`	`*`	List
GetInstanceEndpoint	`cr:GetInstanceEndpoint`	`acs:cr:$regionid:$accountid:instance/$instanceid`	Read
GetInstanceUsage	`cr:GetInstanceUsage`	`acs:cr:$regionid:$accountid:instance/$instanceid`	Read
GetInstanceVpcEndpoint	`cr:GetInstanceVpcEndpoint`	`acs:cr:$regionid:$accountid:instance/$instanceid`	Read
ListInstance	`cr:ListInstance`	`*`	List
ListInstanceEndpoint	`cr:ListInstanceEndpoint`	`acs:cr:$regionid:$accountid:repository/$instanceid`	List
CreateInstanceEndpointAclPolicy	`cr:CreateInstanceEndpointAclPolicy`	`acs:cr:$regionid:$accountid:instance/$instanceid`	Write
CreateInstanceVpcEndpointLinkedVpc	`cr:CreateInstanceVpcEndpointLinkedVpc`	`acs:cr:$regionid:$accountid:instance/$instanceid`	Write
DeleteInstanceEndpointAclPolicy	`cr:DeleteInstanceEndpointAclPolicy`	`acs:cr:$regionid:$accountid:instance/$instanceid`	Write
DeleteInstanceVpcEndpointLinkedVpc	`cr:DeleteInstanceVpcEndpointLinkedVpc`	`acs:cr:$regionid:$accountid:instance/$instanceid`	Write
UpdateInstanceEndpointStatus	`cr:UpdateInstanceEndpointStatus`	`acs:cr:$regionid:$accountid:instance/$instanceid`	Write
GetArtifactBuildRule	`cr:GetArtifactBuildRule`	`acs:cr:$regionid:$accountid:instance/$instanceid`	Read
GetPersonalInstanceDomainAccessStatus	`cr:GetPersonalInstanceDomainAccessStatus`	`acs:cr:$regionid:$accountid:instance/$instanceid`	Read
ListRepositoryVulTagCount	`cr:ListRepoVulTagCount`	`acs:cr:$regionid:$accountid:instance/$instanceid`	List

Namespace

API	Action	Resource	Access level
GetNamespace	`cr:GetNamespace`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename`	Read
ListNamespace	`cr:ListNamespace`	`acs:cr:$regionid:$accountid:repository/$instanceid/*`	List
CreateNamespace	`cr:CreateNamespace`	`acs:cr:$regionid:$accountid:repository/$instanceid`	Write
DeleteNamespace	`cr:DeleteNamespace`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename`	Write
UpdateNamespace	`cr:UpdateNamespace`	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename`	Write

Repositório

API	Action	Resource	Access level
GetRepository	`cr:GetRepository`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
ListRepository	`cr:ListRepository`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/*`	List
CreateRepository	`cr:CreateRepository`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename`	Write
DeleteRepository	`cr:DeleteRepository`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write
UpdateRepository	`cr:UpdateRepository`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write

Tags e camadas de imagem

API	Action	Resource	Access level
GetRepoTagLayers	`cr:GetRepositoryLayers`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
GetRepoTagManifest	`cr:GetRepositoryManifest`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
ListRepoTag	`cr:ListRepositoryTag`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	List
DeleteRepoTag	`cr:DeleteRepositoryTag`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write

Pull, push e autorização

API	Action	Resource	Access level
GetAuthorizationToken	`cr:GetAuthorizationToken`	`*`	Read
PullRepository	`cr:PullRepository`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
PushRepository	`cr:PushRepository`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write

Build

API	Action	Resource	Access level
GetRepoBuildRecord	`cr:GetRepositoryBuildRecord`	`acs:cr:$regionid:$accountid:repository/$instanceid`	Read
GetRepoBuildRecordStatus	`cr:GetBuildRepositoryStatus`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
ListRepoBuildRecord	`cr:ListRepositoryBuild`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	List
ListRepoBuildRecordLog	`cr:GetRepositoryBuildLog`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
ListRepoBuildRule	`cr:ListRepositoryBuildRule`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	List
CancelRepoBuildRecord	`cr:CancelBuildRepository`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write
CreateBuildRecordByRule	`cr:BuildRepositoryByRule`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write
CreateRepoBuildRule	`cr:CreateRepositoryBuildRule`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write
DeleteRepoBuildRule	`cr:DeleteRepositoryBuildRule`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write
UpdateRepoBuildRule	`cr:UpdateRepositoryBuildRule`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write

Sincronização

API	Action	Resource	Access level
GetRepoSyncTask	`cr:GetRepositorySync`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
ListRepoSyncRule	`cr:ListSyncRule`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	List
ListRepoSyncTask	`cr:GetRepositorySync`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	List
CreateRepoSyncRule	`cr:CreateSyncRule`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write
CreateRepoSyncTaskByRule	`cr:CreateRepositorySync`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write
DeleteRepoSyncRule	`cr:DeleteSyncRule`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write

Triggers (webhooks)

API	Action	Resource	Access level
ListRepoTrigger	`cr:ListWebHook`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	List
ListRepoTriggerLog	`cr:GetWebHookLog`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
ListRepoTriggerRecord	`cr:GetWebHookLog`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
CreateRepoTrigger	`cr:CreateWebHook`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write
DeleteRepoTrigger	`cr:DeleteWebHook`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write
UpdateRepoTrigger	`cr:UpdateWebHook`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write

Verificação de vulnerabilidades

API	Action	Resource	Access level
GetRepoTagScanTask	`cr:GetScan`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
GetScan	`cr:GetScan`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
GetScanStatus	`cr:GetScanStatus`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
GetScanCount	`cr:GetScanCount`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Read
ListScanResult	`cr:ListScanResult`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	List
PutScan	`cr:PutScan`	`acs:cr:$regionid:$accountid:repository/$instanceid/$namespacename/$repositoryname`	Write

Helm charts

API	Action	Resource	Access level
GetChartNamespace	`cr:GetNamespace`	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename`	Read
GetChartRepository	`cr:GetRepository`	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname`	Read
ListChartNamespace	`cr:ListNamespace`	`acs:cr:$regionid:$accountid:chart/$instanceid/*`	List
ListChartRelease	`cr:ListChartRelease`	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname`	List
ListChartRepository	`cr:ListRepository`	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/*`	List
CreateChartNamespace	`cr:CreateNamespace`	`acs:cr:$regionid:$accountid:chart/$instanceid`	Write
DeleteChartNamespace	`cr:DeleteNamespace`	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename`	Write
DeleteChartRelease	`cr:DeleteChartRelease`	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname`	Write
DeleteChartRepository	`cr:DeleteRepository`	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname`	Write
UpdateChartNamespace	`cr:UpdateNamespace`	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename`	Write
UpdateChartRepository	`cr:UpdateRepository`	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname`	Write
PullChart	`cr:PullChart`	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname`	Read
PushChart	`cr:PushChart`	`acs:cr:$regionid:$accountid:chart/$instanceid/$chartnamespacename/$chartrepositoryname`	Write