Note:The following scenario policies are only used for TCR Individual use cases.
Grant a sub-account the full read/write permissions for all resources in TCR Individual.
{
"version": "2.0",
"statement": [{
"action": [
"tcr:*"
],
"resource": [
"qcs::tcr:::repo/*"
],
"effect": "allow"
}]
}
Grant a sub-account the read-only permission for all resources in TCR Individual (former Image Repositories in TKE).
{
"version": "2.0",
"statement": [{
"action": [
"tcr:Describe*",
"tcr:PullRepository*"
],
"resource": [
"qcs::tcr:::repo/*"
],
"effect": "allow"
}]
}
Grant a sub-account permissions to manage the specific namespace in the specific region. For example, the namespace team-01
in the default region.
{
"version": "2.0",
"statement": [{
"action": [
"tcr:*"
],
"resource": [
"qcs::tcr:::repo/team-01",
"qcs::tcr:::repo/team-01/*"
],
"effect": "allow"
}
]
}
Grant a sub-account the read-only permission for an image repository, which means that the sub-account can only pull the images in the image repository instead of deleting the repository, modifying repository attributes, or pushing images. For example, the image repository repo-demo
in the namespace team-01
in the default region.
{
"version": "2.0",
"statement": [{
"action": [
"tcr:Describe*",
"tcr:PullRepositoryPersonal"
],
"resource": [
"qcs::tcr:::repo/team-01",
"qcs::tcr:::repo/team-01/repo-demo",
"qcs::tcr:::repo/team-01/repo-demo/*"
],
"effect": "allow"
}
]
}
문제 해결에 도움이 되었나요?