What is the appropriate role for container registry in order to push and pull docker images from the GCR?

Question

"roles/storage.admin" , "roles/artifactregistry.admin" . Which of these roles has access over Google container registry.

"roles/containerregistry.admin", Does this role actually exists. Can it access container registry if exists.

Trying to assign roles for service account through terraform. Thanks in advance :)

Answer 1

You may try to use this Container Registry Service Agent (roles/containerregistry.ServiceAgent). The properties include the following:

• pubsub.topics.publish
• storage.objects.get
• storage.objects.getIamPolicy
• storage.objects.list

For more details and reference regarding the roles, you may check these documentations.[1][2]

[1] https://cloud.google.com/iam/docs/understanding-roles#service-agents-roles

[2] https://cloud.google.com/artifact-registry/docs/transition/map-roles