자동 역할 부여를 중지한 경우 기본 서비스 계정에 부여할 역할을 결정한 후 직접 이러한 역할을 부여해야 합니다.
기본 서비스 계정에 이미 편집자 역할이 있으면 편집자 역할을 권한이 더 낮은 역할로 바꾸는 것이 좋습니다.서비스 계정 역할을 안전하게 수정하려면 정책 시뮬레이터를 사용하여 변경사항의 영향을 확인한 후 적절한 역할을 부여하고 취소합니다.
다음은 다양한 시나리오에 필요한 액세스 범위 및 필요한 역할의 예입니다.
Artifact Registry 저장소에서 컨테이너 이미지를 가져오려면 Compute Engine 서비스 계정에 Artifact Registry 리더 역할 (roles/artifactregistry.reader)을 부여해야 합니다. 또한 Cloud Storage 스토리지 버킷에 read-only액세스 범위가 설정되어 있는지 확인합니다.
VM 인스턴스를 저장소에 업로드하려고 합니다. 이 경우 스토리지에 대한 쓰기 액세스 권한(read-write, cloud-platform 또는 full-control)으로 액세스 범위를 구성해야 합니다.
VM 인스턴스가 액세스하려는 저장소와 다른 프로젝트에 있습니다. 저장소가 있는 프로젝트에서 인스턴스의 서비스 계정에 필요한 권한을 부여합니다.
저장소가 동일한 프로젝트에 있지만 기본 서비스 계정이 모든 저장소에 동일한 수준의 액세스 권한을 갖지 않는 것이 좋습니다. 이 경우 저장소 수준에서 적절한 권한을 부여하고 프로젝트 수준에서 Artifact Registry 권한을 취소해야 합니다.
VM은 커스텀 서비스 계정과 연결됩니다. 서비스 계정에 필요한 권한과 액세스 범위가 있는지 확인합니다.
커스텀 역할을 사용하여 권한을 부여하고 있으며 커스텀 역할에 필요한 Artifact Registry 권한이 없습니다. 필요한 권한을 역할에 추가합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eCompute Engine can directly pull containers from Artifact Registry repositories.\u003c/p\u003e\n"],["\u003cp\u003eThe Compute Engine service account requires Artifact Registry access to pull container images.\u003c/p\u003e\n"],["\u003cp\u003eDisabling the automatic Editor role grant for the default service account is recommended and may require you to manually grant specific roles.\u003c/p\u003e\n"],["\u003cp\u003eTo pull images, the service account needs the Artifact Registry Reader role, and \u003ccode\u003eread-only\u003c/code\u003e access scope should be set for Cloud Storage.\u003c/p\u003e\n"],["\u003cp\u003eWhen working with multiple projects, or custom service accounts, ensure the appropriate permissions and access scopes are configured for the specific account.\u003c/p\u003e\n"]]],[],null,["# Deploying to Compute Engine\n\nCompute Engine can pull containers directly from Artifact Registry\nrepositories.\n\nRequired permissions\n--------------------\n\nThe Compute Engine service account needs access to Artifact Registry in\norder to pull container images.\n\n\nDepending on your organization policy configuration, the default service account might\nautomatically be granted the [Editor role](/iam/docs/roles-overview#basic) on your\nproject. We strongly recommend that you disable the automatic role grant by [enforcing the `iam.automaticIamGrantsForDefaultServiceAccounts` organization policy\nconstraint](/resource-manager/docs/organization-policy/restricting-service-accounts#disable_service_account_default_grants). If you created your organization after May 3, 2024, this\nconstraint is enforced by default.\n\n\nIf you disable the automatic role grant, you must decide which roles to grant to the default\nservice accounts, and then [grant these\nroles](/iam/docs/granting-changing-revoking-access) yourself.\n\n\nIf the default service account already has the Editor role, we recommend that you replace the\nEditor role with less permissive roles.To safely modify the service account's roles, use [Policy Simulator](/policy-intelligence/docs/simulate-iam-policies) to see the impact of\nthe change, and then [grant and revoke the\nappropriate roles](/iam/docs/granting-changing-revoking-access).\n\n\u003cbr /\u003e\n\nSome examples of required access scopes and required roles for different\nscenarios are as follows:\n\n- To pull container images from Artifact Registry repositories, you must grant the Compute Engine service account the Artifact Registry Reader role (`roles/artifactregistry.reader`). Additionally, ensure the `read-only` [access scope](/storage/docs/oauth-scopes) is set for Cloud Storage storage buckets.\n- You want the VM instance to upload to repositories. In this case, you must configure an [access scope](/storage/docs/oauth-scopes) with write access to storage: `read-write`, `cloud-platform`, or `full-control`.\n- The VM instance is in a different project than the repositories that you want to access. In the project with the repositories, [grant](/artifact-registry/docs/access-control#grant) the required permissions to the instance's service account.\n- The repositories are in the same project, but you don't want the default service account to have the same level of access across all repositories. In this case, you must grant the appropriate permissions at the repository level and revoke the Artifact Registry permissions at the project level.\n- The VM is associated with a custom service account. Ensure that the service account has the required permissions and access scope.\n- You are using custom roles to grant permissions and the custom role does not include the required Artifact Registry permissions. Add the required [permissions](/artifact-registry/docs/access-control#permissions) to the role."]]
