Container Registry
Container Registry
Container Registry
Document
Container Registry (CR)
What's new
Overview
Billing
Billing item
Getting started
User guide
User authorization
Authorization management
Robot account management
Instance management
Namespace management
OCI artifact repository management
OCI artifact management
Version management
Tag immutability rule management
Tag retention rules management
Access configuration
Access control
Distribution acceleration
P2P acceleration
Image lazy loading
Registry replication
Audit log management
Alerts and notifications
Best practices
Image push and pull
Image migration and synchronization
DevOps delivery
FAQ
Authorization
VPC
Image push and pull
Limits
Registry replication
P2P acceleration
Access control
API
Calling Method
Instance Management
Namespace Management
OCI Artifact Repository Management
OCI Artifact Version Management
Domain Management
Access Endpoint Management
Temporary Access Key
Robot Account Management
General Data Structure
Artifact repository AR
What's new
Product overview
Getting started
User guide
Instance management
Repository Management
Access control
Permanent access credentials
Temporary access credentials
Maven package management
Generic package management
PyPI package management
NPM package management
Uploading packages
Downloading packages
AI package management
Permission management
API Reference
Repository Management
Package management
Version Management
File Management
Temporary Key Management
General Data Structure
- Documentation
Container RegistryContainer Registry (CR)User guideUser authorizationAuthorization managementAdding system policies
Copy page
Download PDFAuthorization management
Adding system policies
Copy pageDownload PDFAdding system policies
CR supports authorizing IAM (Identity and Access Management) users to enable multi-user collaborative management of CR resources. This topic describes how to authorize IAM users to use instances.
Background
This topic describes how to authorize IAM users to access CR instances quickly via system-preset policies. For operations related to custom policies, see Adding custom policies.
A policy is a method of describing the access control capabilities of IAM. IAM supports the following two types of permission policies:
- System-preset policies: The policies are created by the system in a centralized manner. You can only use but cannot modify them, and the version updates of these policies are maintained by the system.
- User-defined policies: You can create, update, and delete the policies. The version updates of these policies are maintained by yourself.
Prerequisites
- You have registered a system account. For detailed operations, see How to register an account.
- The account has passed the enterprise real-name authentication. For details, see Identity authentication.
Procedure
- Log in to the IAM console .
- Create an IAM user and attach the following policies to the user. For methods to create users and attach policies, see Creating users and authorizing access. For more details about policies, see Managing policies.
- PolicyDescriptionPolicyDescriptionCRFullAccessThis policy allows read and write access to CR. Policy details are as follows:{"Statement": [{"Effect": "Allow","Action": ["cr:*","vpc:Describe*","artifacts:*","bill_volcano_engine:CheckPurchasePermission","bill_volcano_engine:CalculateV2","bill_volcano_engine:ListConfiguration","bill_volcano_engine:GetBalanceStatus","bill_volcano_engine:ListResourcePackage","storage_ebs:CalculatePrice"],"Resource": ["*"]}]}CRReadOnlyAccessThis policy allows read-only access to CR. Policy details are as follows:{"Statement": [{"Effect": "Allow","Action": ["cr:List*","cr:Get*","cr:Pull*","cr:SetUser","artifacts:Get*","artifacts:List*","artifacts:pull","artifacts:*Credential","bill_volcano_engine:CheckPurchasePermission","bill_volcano_engine:CalculateV2","bill_volcano_engine:ListConfiguration","bill_volcano_engine:GetBalanceStatus","bill_volcano_engine:ListResourcePackage","storage_ebs:CalculatePrice"],"Resource": ["*"]}]}
- Authorize the user with the ServiceRoleForCR role. For authorization methods, see Managing roles. Role details are as follows.
warning
After authorization, the role will appear on the role list in the IAM console. If you delete the role, it will make cross-service access unavailable. Please proceed with caution.
- RoleDescriptionRoleDescriptionServiceRoleForCRCR policy for TOS access.
- Associated policy: ServiceRolePolicyForCR
{"Statement": [{"Effect": "Allow","Action": ["vpc:DescribeVpcs","vpc:DescribeSubnets","vpc:DescribeSecurityGroups","vpc:CreateNetworkInterface","vpc:DeleteNetworkInterface","vpc:DescribeNetworkInterfaces","vpc:CreateNetworkInterfacePermission","vpc:DeleteNetworkInterfacePermission","vpc:DescribeNetworkInterfacePermissions","vpc:DescribeVpcAttributes","vpc:DescribeSubnetAttributes","vpc:DescribeNetworkInterfaceAttributes","vpc:AttachNetworkInterface","vpc:DetachNetworkInterface","vpc:AssociateTrunkInterface","vpc:DisassociateTrunkInterface","vpc:DescribeTrunkAssociations","private_zone:CreatePrivateZone","private_zone:UpdatePrivateZone","private_zone:DeletePrivateZone","private_zone:QueryPrivateZone","private_zone:ListPrivateZones","private_zone:CreateRecord","private_zone:DeleteRecord","private_zone:ListRecords","private_zone:UpdateRecord","private_zone:BatchCreateRecord","private_zone:BatchDeleteRecord","dns:ListZones","dns:ListRecords","dns:CreateRecord","dns:DeleteRecord","dns:UpdateRecord","certificate_service:CertificateGetInstance","tls:CreateProject","tls:ModifyProject","tls:DescribeProject","tls:DescribeProjects","tls:CreateTopic","tls:ModifyTopic","tls:DeleteTopic","tls:DescribeTopics","tls:DescribeTopic","tls:CreateIndex","tls:ModifyIndex","tls:DescribeIndex","tls:PutLogs","tls:CreateDashboard","tls:ModifyDashboard","tls:DeleteDashboard","tls:DescribeDashboard","tls:DescribeDashboards","tls:GetAccountStatus","kms:DescribeKey","kms:AsymmetricSign"],"Resource": ["*"]}]}- Trust relationship: CR
{"Statement": [{"Effect": "Allow","Action": ["sts:AssumeRole"],"Principal": {"Service": ["cr"]}}]}
Last updated: 2026.09.23 14:37:20
All rights reserved © Beijing Volcano Engine Technology Co., Ltd2024
