镜像仓库
镜像仓库
镜像仓库
文档指南
请输入
镜像仓库 CR
产品动态
产品计费
用户指南
访问配置
分发加速
监控告警和通知
最佳实践
镜像推拉
DevOps 交付
常见问题
使用限制
实例同步
API 参考
OCI 制品版本管理
域名管理
访问入口管理
临时访问密钥
机器人账户管理
SDK 参考
制品仓库 AR
产品动态
用户指南
API 参考
- 文档首页
镜像仓库镜像仓库 CR用户指南用户授权IAM 授权添加系统策略
复制全文
下载 pdf添加系统策略
文档反馈
问问助手镜像仓库 CR 支持通过授权 IAM（Identity and Access Management）用户，实现多用户协同操作镜像仓库资源的需求。本文主要介绍授权 IAM 用户使用实例的步骤。
背景信息
策略是访问控制 IAM 描述能力的一种方式。IAM 支持以下两种权限策略：
- 系统预设策略：统一由系统创建，您只能使用不能修改，策略的版本更新由系统维护。
- 用户自定义策略：您可以自主创建、更新和删除策略，策略的版本更新由您自己维护。
前提条件
- 已注册系统账号。详细操作，请参见 如何进行账号注册。
- 已完成企业账号实名认证。详细操作，参见 实名认证。
操作步骤
- 登录 访问控制控制台。
- 策略描述策略描述CRFullAccess该策略为镜像仓库的全读写访问权限。 策略详情如下所示：{"Statement": [{"Effect": "Allow","Action": ["cr:*","vpc:Describe*","artifacts:*","bill_volcano_engine:CheckPurchasePermission","bill_volcano_engine:CalculateV2","bill_volcano_engine:ListConfiguration","bill_volcano_engine:GetBalanceStatus","bill_volcano_engine:ListResourcePackage","storage_ebs:CalculatePrice"],"Resource": ["*"]}]}CRReadOnlyAccess该策略为镜像仓库的只读访问权限。 策略详情如下所示：{"Statement": [{"Effect": "Allow","Action": ["cr:List*","cr:Get*","cr:Pull*","cr:SetUser","artifacts:Get*","artifacts:List*","artifacts:pull","artifacts:*Credential","bill_volcano_engine:CheckPurchasePermission","bill_volcano_engine:CalculateV2","bill_volcano_engine:ListConfiguration","bill_volcano_engine:GetBalanceStatus","bill_volcano_engine:ListResourcePackage","storage_ebs:CalculatePrice"],"Resource": ["*"]}]}
- 为用户授权 ServiceRoleForCR 角色，授权方法参见 角色管理，角色详情如下。
注意
- 角色描述角色描述ServiceRoleForCR镜像仓库访问对象存储的策略。
- 关联策略：ServiceRolePolicyForCR
{"Statement": [{"Effect": "Allow","Action": ["vpc:DescribeVpcs","vpc:DescribeSubnets","vpc:DescribeSecurityGroups","vpc:CreateNetworkInterface","vpc:DeleteNetworkInterface","vpc:DescribeNetworkInterfaces","vpc:CreateNetworkInterfacePermission","vpc:DeleteNetworkInterfacePermission","vpc:DescribeNetworkInterfacePermissions","vpc:DescribeVpcAttributes","vpc:DescribeSubnetAttributes","vpc:DescribeNetworkInterfaceAttributes","vpc:AttachNetworkInterface","vpc:DetachNetworkInterface","vpc:AssociateTrunkInterface","vpc:DisassociateTrunkInterface","vpc:DescribeTrunkAssociations","private_zone:CreatePrivateZone","private_zone:UpdatePrivateZone","private_zone:DeletePrivateZone","private_zone:QueryPrivateZone","private_zone:ListPrivateZones","private_zone:CreateRecord","private_zone:DeleteRecord","private_zone:ListRecords","private_zone:UpdateRecord","private_zone:BatchCreateRecord","private_zone:BatchDeleteRecord","dns:ListZones","dns:ListRecords","dns:CreateRecord","dns:DeleteRecord","dns:UpdateRecord","certificate_service:CertificateGetInstance","tls:CreateProject","tls:ModifyProject","tls:DescribeProject","tls:DescribeProjects","tls:CreateTopic","tls:ModifyTopic","tls:DeleteTopic","tls:DescribeTopics","tls:DescribeTopic","tls:CreateIndex","tls:ModifyIndex","tls:DescribeIndex","tls:PutLogs","tls:CreateDashboard","tls:ModifyDashboard","tls:DeleteDashboard","tls:DescribeDashboard","tls:DescribeDashboards","tls:GetAccountStatus","kms:DescribeKey","kms:AsymmetricSign"],"Resource": ["*"]}]}- 信任关系：CR
{"Statement": [{"Effect": "Allow","Action": ["sts:AssumeRole"],"Principal": {"Service": ["cr"]}}]}
最近更新时间：2026.05.28 17:58:53
这个页面对您有帮助吗？
有用
有用
无用
无用