The artifacts repository supports enabling multi-user collaborative operations on repository resources by authorizing IAM (Identity and Access Management) users. This section primarily introduces the steps for authorizing IAM users to use the Basic Edition instances.

A policy is a method of describing the access control capabilities of IAM. IAM supports the following two types of permission policies:

System-preset policies: The policies are created by Volcano Engine in a centralized manner. You can only use but cannot modify them, and the version updates of these policies are maintained by Volcano Engine.

User-defined policies: You can create, update, and delete the policies. The version updates of these policies are maintained by yourself.

Predefined policy

The artifact repository provides three system preset policies, and you can directly create IAM users and reference system preset policies to assign user permissions. The descriptions of the preset policies are shown in the table below.

System-preset Policies	Description
ArtifactsFullAccess	Artifact repository administrator permissions (full read-write permissions). This grants the highest level of permissions in the artifact repository, allowing operations on all resources and users within it, The following processes are available: Support for creating, modifying, and deleting instances. Support for creating, modifying, and deleting repositories. Support for uploading, downloading, and deleting packages. Support for creating and managing permanent and temporary credentials for all accounts.
ArtifactsNormalAccess	Artifact repository regular user permissions. This provides operation permissions at the package level within the artifact repository, The following processes are available: Support for uploading, downloading, and deleting packages. Support for creating and managing permanent and temporary credentials for the current account. tip When granting regular user permissions, authorization is applied to all Repository resources under an instance. Fine-grained authorization for specific Repositories is not currently supported. For example, when you grant regular user permissions to User A, this user simultaneously possesses regular user permissions for multiple artifact repositories such as Repository A and Repository B.
ArtifactsReadOnlyAccess	Artifact repository read-only user permissions. This grants read-only permissions in the artifact repository, allowing operations on only some resources, The following processes are available: Support for viewing resources such as instances, repositories, and packages, but not for creating or deleting resources. Support for downloading packages, but not for uploading or deleting them. Support for creating and managing permanent and temporary credentials for the current account.

Custom policies

A user-defined custom policy consists of a series of Statements, and each Statement consists of Effect, Action, and Resource:

Effect: Fill in Allow or Deny. Effect indicates whether this Statement is of an approving or denying nature.

Action: Indicates the scope of action that satisfies the Effect in the Statement.

Resource: Indicates the list of Resources that satisfy the Effect in the Statement. A Resource in the cloud platform is usually expressed in the form of TRN, which is composed of Service, Region, Account_ID, and Resource_Type/ID.

The following is an example policy, which allows browsing all packages. and permits uploading or downloading packages from a specific repository.

Container Registry