---
name: Registry-registry_users
title: Defining IAM access policies for Container Registry
description: As an administrator, you can define IBM Cloud® Identity and Access Management (IAM) access policies to create different levels of access for different users in IBM Cloud® Container Registry. For example, you can authorize some users to view quotas and other users to set quotas.
last-updated: 2026-04-15
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/Registry?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Defining IAM access policies for Container Registry
{: #user}

As an administrator, you can define IBM Cloud® Identity and Access Management (IAM) access policies to create different levels of access for different users in IBM Cloud® Container Registry. For example, you can authorize some users to view quotas and other users to set quotas.
{: shortdesc}

You must define IAM [access policies](#x2853407){: term} for every user that works with IBM Cloud Container Registry. The scope of an IAM access policy is based on the user's role or roles that determine the actions that they are allowed to do. Some roles are predefined, but custom roles can be defined.

To find out more about IAM access policies, see [Platform and service access roles for permissions](https://cloud.ibm.com/docs/iam?topic=iam-userroles&format=markdown).

You can assign Container Registry namespaces to a [resource group](https://cloud.ibm.com/docs/account?topic=account-rgs&format=markdown) and scope access policies to that group, see [Planning namespaces](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_setup_cli_namespace&format=markdown#registry_setup_cli_namespace_plan). However, you can still define access policies that are scoped to individual Container Registry namespaces or to all namespaces that are owned by the account.

## Creating policies
{: #create}
{: help}
{: support}

Before you begin, complete the following tasks:

- Decide on the roles that each user needs and on which resources in IBM Cloud Container Registry, see [IAM roles](https://cloud.ibm.com/docs/Registry?topic=Registry-iam&format=markdown#iam). You can create multiple policies, for example, you can grant write access on a resource but grant read access only on another resource. Policies are additive, which means that a global read policy and a resource-scoped write policy grants both read and write access on that resource.

- [Invite users to an account](https://cloud.ibm.com/docs/iam?topic=iam-iamuserinv&interface=ui&format=markdown#invite-users-access).

    If you want users to create clusters in IBM Cloud Kubernetes Service, ensure that you assign the IBM Cloud Container Registry Administrator role to those users, and don't assign a resource group. For more information, see [Preparing your account to create clusters](https://cloud.ibm.com/docs/containers?topic=containers-clusters&format=markdown).
    {: tip}

To create policies for IBM Cloud Container Registry, the service name field must be `container-registry`.

If you want to access resources, you must assign roles to users or service IDs. If you want to grant access to everything, don't specify a resource type or a resource. If you want to grant access to a specific namespace, specify the resource type as `namespace` and use the namespace name as the resource.

- To create a policy for users, see [Managing access to resources](https://cloud.ibm.com/docs/iam?topic=iam-assign-access-resources&interface=ui&format=markdown).
- To create a policy for service IDs, run the `ibmcloud iam service-policy-create` command or use the IBM Cloud console to bind roles to your service IDs. To create policies, you must have the Administrator role. You automatically have the Administrator role on your own account. For more information, see [Creating and working with service IDs](https://cloud.ibm.com/docs/iam?topic=iam-serviceids&interface=ui&format=markdown#serviceids) and [Managing access to resources](https://cloud.ibm.com/docs/iam?topic=iam-assign-access-resources&interface=ui&format=markdown).

For an example of useful access policies for IBM Cloud Container Registry, see [Granting access to Container Registry resources tutorial](https://cloud.ibm.com/docs/Registry?topic=Registry-iam_access&format=markdown).
{: tip}

## Setting up region-based policies for IAM
{: #create_region_policy_iam}

For all regions other than global you can use the region field when you create a rule. So for example in the command-line interface (CLI), for `us-south` you use the `--region us-south` option. However, because global is a geography and not a region you must omit the `--region` option and add `geography=global` into the `--attributes` field.

### Region-based user policies
{: #create_region_policy_user}

The following example shows the command for creating a user policy to assign a role to a user in `us-south`, where `USER_ID` is the user ID (`name@example.com`) and `ROLES` is the role or roles that you want to allocate:

```txt
ibmcloud iam user-policy-create USER_ID --roles ROLES --service-name container-registry --region us-south
```
{: pre}

The following example shows the command for creating a user policy to assign a role to a user in `global`, where `USER_ID` is the user ID (`name@example.com`) and `ROLES` is the role or roles that you want to allocate:

```txt
ibmcloud iam user-policy-create USER_ID --roles ROLES --service-name container-registry --attributes "geography=global"
```
{: pre}

### Region-based service ID policies
{: #create_region_policy_service}

The following example shows the command for creating a service ID policy in `us-south`, where `SERVICE_ID` is the service ID and `ROLES` is the role or roles that you want to allocate:

```txt
ibmcloud iam service-policy-create SERVICE_ID --roles ROLES --service-name container-registry --region us-south
```
{: pre}

The following example shows the command for creating a service ID policy in `global`, where `SERVICE_ID` is the service ID and `ROLES` is the role or roles that you want to allocate:

```txt
ibmcloud iam service-policy-create SERVICE_ID --roles ROLES --service-name container-registry --attributes "geography=global"
```
{: pre}