Understanding Permissions in Google Artifact Registry

Last updated: June 25, 2026

When working with Docker and Google Cloud’s Artifact Registry, you might encounter issues related to pulling images

Core Issue: Permissions and Projects

  • Pull by Tag:

    • Example: LOCATION=us, IMAGE=python-image-analytics, TAG=latest
      URI: us-docker.pkg.dev/v2/$PROJECT-ID/$REPOSITORY/python-image-analytics/manifests/latest

If privileges are missing, an error occurs during this tag resolution step, resulting in a 403 Forbidden message.

Root Cause Analysis

For service accounts used by Compute Engine, Cloud Run, or Google Kubernetes Engine:

  • Lack of Permission for Tag Resolution: Often due to missing the Artifact Registry Reader role (roles/artifactregistry.reader).

Diagnostic Steps

1.  Test Tag Resolution: 

curl -H "Authorization: Bearer $(gcloud auth print-access-token)" \
https://$LOCATION-docker.pkg.dev/v2/$PROJECT-ID/$REPOSITORY/$IMAGE/manifests/$TAG

 

2. Check IAM Permissions: 

gcloud projects get-iam-policy ck-corp-artifact-registry --flatten="bindings[].members" \
 --filter="bindings.members:$(gcloud auth list --filter=status:ACTIVE --format='value(account)')"

This helps verify if the necessary roles are assigned to your service account.

 

3. Verify Repository-Level Permissions: 

gcloud artifacts repositories get-iam-policy ckdocker --location=$LOCATION --project=$PROJECT-ID

Verifies that permissions have been correctly set at the repository level.

 

Solutions

Option 1: Grant Proper IAM Role

To resolve permission issues:

  • Assign the Artifact Registry Reader role (roles/artifactregistry.reader) to your service account or user. This can be done at both project and repository levels.

  • ## Assignment Examples

    For a Service Account: 

  • gcloud projects add-iam-policy-binding $PROJECT-ID \
    --member="serviceAccount:$SERVICE-ACCOUNT-EMAIL" \
    --role="roles/artifactregistry.reader"

    For a User: 


  • gcloud projects add-iam-policy-binding $PROJECT-ID \
    --member="user:$USER-EMAIL" \
    --role="roles/artifactregistry.reader"

 

Key Takeaway

  • By following the diagnostic steps and solutions outlined above, you should be able to address common permission-related issues when working with Google Artifact Registry and Docker.
  • Should your issue happen during migration of projects or moving between different Registries, please ensure you've updated all the links, and all the tags.
  • Potential issues can affect this if you're still using the old links or permissions on the Project and Service Account are not aligned

 

Note:

These instructions are created by Coder as a Best Effort to diagnose a GCP Error but need to be independently tested and are not guaranteed to work and are not part of the Support Scope.