yandex_container_repository_iam_binding (Resource)

Allows creation and management of a single binding within IAM policy for an existing repository.

Example usageExample usage

//
// Create a new Container Repository and new IAM Binding for it.
//
resource "yandex_container_registry" "your-registry" {
  folder_id = "your-folder-id"
  name      = "registry-name"
}

resource "yandex_container_repository" "repo-1" {
  name = "${yandex_container_registry.your-registry.id}/repo-1"
}

resource "yandex_container_repository_iam_binding" "puller" {
  repository_id = yandex_container_repository.repo-1.id
  role          = "container-registry.images.puller"

  members = [
    "system:allUsers",
  ]
}

SchemaSchema

RequiredRequired

• members (Set of String) An array of identities that will be granted the privilege in the role. Each entry can have one of the following values:

• userAccount:{user_id}: A unique user ID that represents a specific Yandex account.
• serviceAccount:{service_account_id}: A unique service account ID.
• federatedUser:{federated_user_id}: A unique federated user ID.
• federatedUser:{federated_user_id}:: A unique SAML federation user account ID.
• group:{group_id}: A unique group ID.
• system:group:federation:{federation_id}:users: All users in federation.
• system:group:organization:{organization_id}:users: All users in organization.
• system:allAuthenticatedUsers: All authenticated users.
• system:allUsers: All users, including unauthenticated ones.

• repository_id (String) The ID of the compute repository to attach the policy to.
• role (String) The role that should be assigned. Only one yandex_container_repository_iam_binding can be used per role.

OptionalOptional

• sleep_after (Number) For test purposes, to compensate IAM operations delay

ImportImport

The resource can be imported by using their resource ID. For getting the resource ID you can use Yandex Cloud Web Console or YC CLI.

IAM binding imports use space-delimited identifiers; first the resource in question and then the role. These bindings can be imported using the repository_id and role.

# terraform import yandex_container_registry_iam_binding.<binding Name> "<registry_id>,<resource Role>"
terraform import yandex_container_registry_iam_binding.puller "crps9**********k9psn,container-registry.images.puller"