Access management in Container Registry

In this section, you'll learn:

• Which resources you can assign roles to.
• Which roles exist in the service.
• Which roles are required for particular actions.

About access managementAbout access management

All transactions in Nebius Israel are checked by the Identity and Access Management service. If a subject doesn't have the required permission, the service returns an error.

To grant permission for a resource, assign roles for this resource to the subject that will perform operations. Roles can be assigned to a Google account, a service account, federated users, a user group, or a system group. For more information, see How access management works in Nebius Israel.

Only users with the admin or resource-manager.clouds.owner role for a resource can assign roles for this resource.

What resources you can assign roles toWhat resources you can assign roles to

You can assign a role to a cloud, a folder, a registry, or a repository. These roles also apply to nested resources.

What roles exist in the serviceWhat roles exist in the service

The chart below shows which roles are available in the service and how they inherit each other's permissions. For example, the editor role includes all the permissions of viewer. You can find the description of each role under the chart.

Service rolesService roles

Role	Permissions
container-registry.admin	Lets you create, edit, and delete registries. Lets you configure access rights to service resources.
container-registry.images.puller	Lets you download Docker images and view information about service resources (registries, Docker images, and repositories).
container-registry.images.pusher	Lets you manage Docker images and view information about service resources (registries, Docker images, and repositories).
resource-manager.clouds.member	A role everyone requires to access cloud resources, except for cloud owners and service accounts.
resource-manager.clouds.owner	Grants you full access to a cloud and the resources in it. You can only assign this role for a cloud.
container-registry.viewer	Lets you view information about registries, Docker images, and repositories.
container-registry.editor	Lets you create, update, and delete registries, Docker images, and repositories.
container-registry.images.scanner	Lets you scan Docker images and view information about service resources (registries, Docker images, and repositories).

For more information about service roles, see Roles in the Identity and Access Management service documentation.

Primitive rolesPrimitive roles

auditorauditor

Grants permission to view service configuration and metadata without access to data.

viewerviewer

Enables you to view information about resources.

editoreditor

Allows you to manage resources, e.g., create, edit, and delete them.

adminadmin

Allows you to manage your resources and access to them.

For more information about primitive roles, see Roles.

What roles do I needWhat roles do I need

The table below lists the roles needed to perform a given action. You can always assign a role granting more permissions than the role specified. For example, you can assign editor instead of viewer.

Action	Methods	Required roles
View data
Get a list of registries.	list	container-registry.viewer for a folder.
Get information about registries, Docker images, and repositories.	get, list	container-registry.viewer for the registry containing the resource.
Pulling a Docker image.	—	container-registry.images.puller for the registry or repository.
Getting information on lifecycle policies and the outcomes of their dry runs.	get, list, getDryRunResult, listDryRunResults	container-registry.viewer for the registry or repository that the lifecycle policy was created for.
Manage resources
Create registries in a folder.	create	container-registry.editor for a folder.
Update and delete registries	update, delete	container-registry.editor for the specified registry.
Create Docker images using basic Docker images from the registry	—	container-registry.images.puller for the registry or repository.
Create Docker images without using basic Docker images from the registry.	—	No roles required.
Push Docker images to the registry.	—	container-registry.images.pusher for the registry or repository.
Delete Docker images.	delete	container-registry.images.pusher for a registry or repository containing a Docker image.
Creating, editing, deleting, and performing a dry run of a lifecycle policy.	create, update, delete, dryRun	container-registry.editor for the registry or repository that the lifecycle policy was created for.
Manage resource access
Granting a role, revoking a role, and viewing the roles assigned to a folder, a cloud, or a registry.	setAccessBindings, updateAccessBindings, listAccessBindings	admin for the resource.

What's next {what-is-next}What's next

• Assigning a role.
• Viewing assigned roles.
• Revoking a role.
• Learn more about access management in Nebius Israel.
• More information on inheriting roles.