Access management in Container Registry

In this section, you will learn:

• Which resources you can assign roles to.
• Which roles exist in the service.
• Which roles are required for particular actions.

About access managementAbout access management

In Yandex Cloud, all transactions are checked in Yandex Identity and Access Management. If a subject does not have the required permission, the service returns an error.

To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Yandex account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Yandex Cloud.

Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.

Which resources you can assign roles toWhich resources you can assign roles to

You can assign a role to a cloud, a folder, a registry, or a repository. These roles also apply to nested resources.

Which roles exist in the serviceWhich roles exist in the service

The chart below shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all the permissions of viewer. You can find the description of each role under the chart.

Service rolesService roles

Role	Permissions
container-registry.viewer	Allows you to read information about registries, Docker images, and repositories.
container-registry.editor	Allows you to create, edit, and delete registries, Docker images, and repositories. It includes all permissions granted by the container-registry.viewer role.
container-registry.admin	Allows you to manage access to registries, Docker images, and repositories. It includes all permissions granted by the container-registry.viewer and container-registry.editorroles.
container-registry.images.pusher	Allows you to manage Docker images and view information about service resources (registries, Docker images, and repositories).
container-registry.images.puller	Allows you to download Docker images and view information about service resources (registries, Docker images, and repositories).
container-registry.images.scanner	Allows you to scan Docker images for vulnerabilities and view information about service resources (registries, Docker images, and repositories).
resource-manager.clouds.owner	Grants you full access to a cloud and the resources in it. You can only assign this role for a cloud.
resource-manager.clouds.member	Role everyone requires to access cloud resources, except for cloud owners and service accounts.

For more information about service roles, see Roles in the Yandex Identity and Access Management service documentation.

Primitive rolesPrimitive roles

auditorauditor

Grants permission to view service configuration and metadata without access to data.

viewerviewer

Enables you to view information about resources.

editoreditor

Allows you to manage resources, e.g., create, edit, and delete them.

adminadmin

Allows you to manage your resources and access to them.

For more information about primitive roles, see Roles.

What roles do I needWhat roles do I need

The table below lists the roles needed to perform a particular action. You can always assign a role granting more permissions than the role specified. For example, you can assign the editor role instead of the viewer one.

Action	Methods	Required roles
View data
Get a list of registries.	list	container-registry.viewer for a folder.
Get information about registries, Docker images, and repositories.	get, list	container-registry.viewer for the registry containing the resource.
Pulling a Docker image.	pull	container-registry.images.puller for the registry or repository.
Getting information on lifecycle policies and the outcomes of their dry runs.	get, list, getDryRunResult, listDryRunResults	container-registry.viewer for the registry or repository that the lifecycle policy was created for.
Manage resources
Create registries in a folder.	create	container-registry.editor for a folder.
Update and delete registries	update, delete	container-registry.editor for the specified registry.
Create Docker images using basic Docker images from the registry	N/A	container-registry.images.puller for the registry or repository.
Create Docker images without using basic Docker images from the registry.	N/A	No roles required.
Push Docker images to the registry.	push	container-registry.images.pusher for the registry or repository.
Delete Docker images.	delete	container-registry.images.pusher for a registry or repository containing a Docker image.
Creating, editing, deleting, and performing a dry run of a lifecycle policy.	create, update, delete, dryRun	container-registry.editor for the registry or repository that the lifecycle policy was created for.
Manage resource access
Granting a role, revoking a role, and viewing the roles assigned to a folder, a cloud, or a registry.	setAccessBindings, updateAccessBindings, listAccessBindings	admin for the resource.
Scanning for vulnerabilities
Scanning a Docker image.	scan	container-registry.images.scanner for a registry or repository containing a Docker image.
Getting the results of a Docker image scan.	get, getLast, list, listVulnerabilities	container-registry.images.scanner for a registry or repository containing a Docker image.

What's next {what-is-next}What's next

• Assigning a role.
• Viewing assigned roles.
• Revoking a role.
• Learn more about access management in Yandex Cloud.
• Learn more about inheriting roles.