gcp-ar-admin
roles/artifactregistry.admin or roles/artifactregistry.repoAdmin grants full control over an Artifact Registry repository, including push, policy mutation, and deletion.
match (effective permission)
{
"action": "artifactregistry.repositories.setIamPolicy",
"resource_type": "google.artifactregistry.Repository"
}
where
principal also holds artifactregistry.repositories.uploadArtifacts AND artifactregistry.repositories.update on the same repo (i.e. repoAdmin or admin role, not setIamPolicy alone)
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <Artifact Registry repository in scope> |
| permissions | artifactregistry.repositories.uploadArtifacts artifactregistry.repositories.update artifactregistry.repositories.setIamPolicy artifactregistry.repositories.delete artifactregistry.tags.create artifactregistry.tags.update artifactregistry.tags.delete artifactregistry.versions.delete |
| state logic | ACTIVE when the combined set of admin permissions is effective. BLOCKED if an IAM deny policy denies any of the key permissions. Inherits weakest from contributing role binding. Can-control roll-up applies via can-control.yaml. |
Narrative
{principal.name} has full administrative control over repository {repo.name} (roles/artifactregistry.admin / roles/artifactregistry.repoAdmin): can push, delete, retag, set policy, and reconfigure the repository.
Raw rule rules/derived/gcp/artifactregistry.yaml
id: gcp-ar-admin
emits: CanAdminister
description: roles/artifactregistry.admin or roles/artifactregistry.repoAdmin grants full control over
an Artifact Registry repository, including push, policy mutation, and deletion.
match_effective_permission:
action: artifactregistry.repositories.setIamPolicy
resource_type: google.artifactregistry.Repository
where:
- principal also holds artifactregistry.repositories.uploadArtifacts AND artifactregistry.repositories.update
on the same repo (i.e. repoAdmin or admin role, not setIamPolicy alone)
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <Artifact Registry repository in scope>
permissions:
- artifactregistry.repositories.uploadArtifacts
- artifactregistry.repositories.update
- artifactregistry.repositories.setIamPolicy
- artifactregistry.repositories.delete
- artifactregistry.tags.create
- artifactregistry.tags.update
- artifactregistry.tags.delete
- artifactregistry.versions.delete
conditions: []
state_logic: ACTIVE when the combined set of admin permissions is effective. BLOCKED if an IAM deny
policy denies any of the key permissions. Inherits weakest from contributing role binding. Can-control
roll-up applies via can-control.yaml.
confidence: 0.95
derived_from:
- effective roles/artifactregistry.admin or roles/artifactregistry.repoAdmin on <repo>
false_positive_note: "setIamPolicy alone (without uploadArtifacts + update) is CanModifyPolicy, not\
\ CanAdminister. Verify the full permission set is granted before emitting CanAdminister. A project-level\
\ roles/viewer grants read but not admin \u2014 check the resolved role, not just a partial set. roles/artifactregistry.admin\
\ at project scope covers ALL repos in the project; emit CanAdminister per repo. The target_type is\
\ resolved at emit time from the repository's generic_type (ContainerRegistry for Docker/OCI, ArtifactRepository\
\ for package repos)."
narrative: '{principal.name} has full administrative control over repository {repo.name} (roles/artifactregistry.admin
/ roles/artifactregistry.repoAdmin): can push, delete, retag, set policy, and reconfigure the repository.'