When authorizing an API operation to access a Container Registry resource using a tag specified by the target.resource.tag policy variable, you must apply the tag to a resource appropriate for the API operation:
API
Can you apply a tag to a resource to authorize access?
If yes, which resource
ListContainerRepositories
No
None
ListContainerImages
No
None
ListContainerImageSignatures
No
None
GetContainerConfiguration
No
None
GetContainerRepository
Yes
Repository
GetContainerImage
Yes
Image
GetContainerImageSignature
Yes
Image signature
CreateContainerRepository
No
None
DeleteContainerRepository
Yes
Repository
UpdateContainerImage
Yes
Image
DeleteContainerImage
Yes
Image
RestoreContainerImage
Yes
Image
CreateContainerImageSignature
No
None
UpdateContainerImageSignature
Yes
Image signature
DeleteContainerImageSignature
Yes
Image signature
RemoveContainerVersion
Yes
Image
UpdateContainerRepository
Yes
Repository
ChangeContainerRepositoryCompartment
Yes
Repository
UpdateContainerConfiguration
No
None
Details for Verb + Resource-Type Combinations 🔗
The following tables show the permissions and API operations covered by each verb. The level of access is cumulative as you go from inspect > read > use > manage. For example, a group that can use a resource can also inspect and read that resource. A plus sign (+) in a table cell indicates incremental access compared to the cell directly above it, whereas "no extra" indicates no incremental access.
For example, the read verb for the repos resource-type
includes the same permissions and API operations as the inspect verb,
plus the REPOSITORY_READ permission and a number of API operations (e.g.,
GetContainerRepository, etc.). The use verb covers
still another permission and API operation compared to read. Lastly,
manage covers more permissions and operations compared to
use.