This document describes how to enable sub-accounts to view and use the TCR related resources through the CAM policy, including specific operation steps and common policy configuration examples.

Note：

If you need the permissions of other Tencent Cloud services when using some features in TCR console such as VPC, CloudAudit, Tag, please see the corresponding CAM Guide in [CAM-Enabled Products](https://intl.cloud.tencent.com/ Document/product/598/10588).

Directions

This document takes the example of "granting the sub-account the read-only permission of an image repository" to introduce how to create a policy.

• Instance ID: tcr-xxxxxxxx
• Namespace: team-01
• Image repository: repo-demo

Common Policy Configuration

If you need to customize the policy JSON, please see CAM APIs for Enterprise Edition and Syntax Logic.

Preset policy configuration

• QcloudTCRFullAccess: full read/write permission of TCR.
  After the policy is bound to a sub-account, the sub-account has all operation permissions for all TCR resources, including the Enterprise Edition and the Personal Edition in TKE.

  {
    "version": "2.0",
    "statement": [{
        "action": [
            "tcr:*"
        ],
        "resource": "*",
        "effect": "allow"
    }]
  }
  

• QcloudTCRReadOnlyAccess: read-only permission of TCR.
  After the policy is bound to a sub-account, the sub-account has the read-only permission for all TCR resources, including the Enterprise Edition and the Personal Edition in TKE.

  {
    "version": "2.0",
    "statement": [{
        "action": [
            "tcr:Describe*",
            "tcr:PullRepository*"
        ],
        "resource": "*",
        "effect": "allow"
    }]
  }
  

Policy configuration in typical scenarios

Note：

The policies in the following use cases are used only for the Enterprise Edition. For the policies used for Personal Edition, please see Example of Authorization Solution of the Personal Edition.

• Grant a sub-account all read/write operation permissions for all resources in the TCR Enterprise Edition instance.

  {
    "version": "2.0",
    "statement": [{
        "action": [
            "tcr:*"
        ],
        "resource": [
            "qcs::tcr:::instance/*",
            "qcs::tcr:::repository/*"
        ],
        "effect": "allow"
    }]
  }
  

• Grant a sub-account the read-only operation permission for all resources in the TCR Enterprise Edition instance.

  {
    "version": "2.0",
    "statement": [{
        "action": [
            "tcr:Describe*",
            "tcr:PullRepository*"
        ],
        "resource": [
            "qcs::tcr:::instance/*",
            "qcs::tcr:::repository/*"
        ],
        "effect": "allow"
    }]
  }
  

• Authorize a sub-account to manage the specified instance, for example, dev-guangzhou whose instance ID is tcr-xxxxxxxx.

  {
    "version": "2.0",
    "statement": [{
        "action": [
            "tcr:*"
        ],
        "resource": [
            "qcs::tcr:::instance/tcr-xxxxxxxx"
        ],
        "effect": "allow"
    }]
  }
  

• Authorize a sub-account to manage the specified namespace in the specified instance, for example, team-01 under the instance tcr-xxxxxxxx.

  {
    "version": "2.0",
    "statement": [{
            "action": [
                "tcr:*"
            ],
            "resource": [
                "qcs::tcr:::repository/tcr-xxxxxxxx/team-01/*"
            ],
            "effect": "allow"
        },
        {
            "action": [
                "tcr:DescribeInstance*"
            ],
            "resource": [
                "qcs::tcr:::repository/tcr-xxxxxxxx"
            ],
            "effect": "allow"
        }
    ]
  }
  

• Authorize a sub-account the read-only permission of an image repository, which means that the sub-account can only pull the images in the image repository instead of deleting a repository, modifying repository attributes, or pushing images, for example, repo-demo in the namespace team-01 under the instance tcr-xxxxxxxx.

  {
    "version": "2.0",
    "statement": [{
            "action": [
                "tcr:DescribeRepositories",
                "tcr:PullRepository",
                "tcr:DescribeNamespaces"
            ],
            "resource": [
                "qcs::tcr:::repository/tcr-xxxxxxxx/team-01/repo-demo/*"
            ],
            "effect": "allow"
        },
        {
            "action": [
                "tcr:DescribeInstance*"
  
            ],
            "resource": [
                "qcs::tcr:::instance/tcr-xxxxxxxx"
            ],
            "effect": "allow"
        }
    ]
  }