文档中心

镜像仓库

IAM 授权

添加系统策略

镜像仓库 CR 支持通过授权 IAM（Identity and Access Management）用户，实现多用户协同操作镜像仓库资源的需求。本文主要介绍授权 IAM 用户使用实例的步骤。

背景信息

本文主要介绍通过系统预设策略，快速授权 IAM 用户使用镜像仓库实例的步骤。自定义策略相关操作，请参见添加自定义策略。

策略是访问控制 IAM 描述能力的一种方式。IAM 支持以下两种权限策略：

系统预设策略：统一由系统创建，您只能使用不能修改，策略的版本更新由系统维护。

用户自定义策略：您可以自主创建、更新和删除策略，策略的版本更新由您自己维护。

前提条件

已注册系统账号。详细操作，请参见如何进行账号注册。

已完成企业账号实名认证。详细操作，参见实名认证。

操作步骤

登录访问控制控制台。

创建 IAM 用户并为用户授权如下策略。创建和授权策略的方法参见创建用户并授。更多策略相关介绍和配置参见策略管理。

策略	描述
CRFullAccess	该策略为镜像仓库的全读写访问权限。策略详情如下所示： { "Statement": [ { "Effect": "Allow", "Action": [ "cr:", "vpc:Describe", "artifacts:", "bill_volcano_engine:CheckPurchasePermission", "bill_volcano_engine:CalculateV2", "bill_volcano_engine:ListConfiguration", "bill_volcano_engine:GetBalanceStatus", "bill_volcano_engine:ListResourcePackage", "storage_ebs:CalculatePrice" ], "Resource": [ "" ] } ] }
CRReadOnlyAccess	该策略为镜像仓库的只读访问权限。策略详情如下所示： { "Statement": [ { "Effect": "Allow", "Action": [ "cr:List", "cr:Get", "cr:Pull", "cr:SetUser", "artifacts:Get", "artifacts:List", "artifacts:pull", "artifacts:Credential", "bill_volcano_engine:CheckPurchasePermission", "bill_volcano_engine:CalculateV2", "bill_volcano_engine:ListConfiguration", "bill_volcano_engine:GetBalanceStatus", "bill_volcano_engine:ListResourcePackage", "storage_ebs:CalculatePrice" ], "Resource": [ "*" ] } ] }

为用户授权 ServiceRoleForCR 角色，授权方法参见角色管理，角色详情如下。

注意

授权后角色将出现在访问控制的角色列表中，删除角色将导致跨服务访问不可用，请谨慎操作。

角色

描述

ServiceRoleForCR

镜像仓库访问对象存储的策略。

关联策略：ServiceRolePolicyForCR

{​
  "Statement": [​
    {​
      "Effect": "Allow",​
      "Action": [​
        "vpc:DescribeVpcs",​
        "vpc:DescribeSubnets",​
        "vpc:DescribeSecurityGroups",​
        "vpc:CreateNetworkInterface",​
        "vpc:DeleteNetworkInterface",​
        "vpc:DescribeNetworkInterfaces",​
        "vpc:CreateNetworkInterfacePermission",​
        "vpc:DeleteNetworkInterfacePermission",​
        "vpc:DescribeNetworkInterfacePermissions",​
        "vpc:DescribeVpcAttributes",​
        "vpc:DescribeSubnetAttributes",​
        "vpc:DescribeNetworkInterfaceAttributes",​
        "vpc:AttachNetworkInterface",​
        "vpc:DetachNetworkInterface",​
        "vpc:AssociateTrunkInterface",​
        "vpc:DisassociateTrunkInterface",​
        "vpc:DescribeTrunkAssociations",​
        "private_zone:CreatePrivateZone",​
        "private_zone:UpdatePrivateZone",​
        "private_zone:DeletePrivateZone",​
        "private_zone:QueryPrivateZone",​
        "private_zone:ListPrivateZones",​
        "private_zone:CreateRecord",​
        "private_zone:DeleteRecord",​
        "private_zone:ListRecords",​
        "private_zone:UpdateRecord",​
        "private_zone:BatchCreateRecord",​
        "private_zone:BatchDeleteRecord",​
        "dns:ListZones",​
        "dns:ListRecords",​
        "dns:CreateRecord",​
        "dns:DeleteRecord",​
        "dns:UpdateRecord",​
        "certificate_service:CertificateGetInstance",​
        "tls:CreateProject",​
        "tls:ModifyProject",​
        "tls:DescribeProject",​
        "tls:DescribeProjects",​
        "tls:CreateTopic",​
        "tls:ModifyTopic",​
        "tls:DeleteTopic",​
        "tls:DescribeTopics",​
        "tls:DescribeTopic",​
        "tls:CreateIndex",​
        "tls:ModifyIndex",​
        "tls:DescribeIndex",​
        "tls:PutLogs",​
        "tls:CreateDashboard",​
        "tls:ModifyDashboard",​
        "tls:DeleteDashboard",​
        "tls:DescribeDashboard",​
        "tls:DescribeDashboards",​
        "tls:GetAccountStatus",​
        "kms:DescribeKey",​
        "kms:AsymmetricSign"​
      ],​
      "Resource": [​
        "*"​
      ]​
    }​
  ]​
}​

信任关系：CR

{​
  "Statement": [​
    {​
      "Effect": "Allow",​
      "Action": [​
        "sts:AssumeRole"​
      ],​
      "Principal": {​
        "Service": [​
          "cr"​
        ]​
      }​
    }​
  ]​
}​

最近更新时间：2026.05.28 17:58:53

这个页面对您有帮助吗？

有用

无用