coreweave_container_registry_access_configuration (Resource)

​

Example usage

variable "org_id" {
  type = string
}

resource "coreweave_container_registry_namespace" "images" {
  name                         = "example-images"
  zone                         = "US-LAB-01A"
  initial_access_configuration = {}
}

resource "coreweave_container_registry_access_configuration" "images" {
  namespace = coreweave_container_registry_namespace.images.name
  policy_sets = {
    readers = {
      identity_selector = "COREWEAVE"
      rules = {
        pull = {
          expression = "identity[\"org_id\"] == ${jsonencode(var.org_id)} && \"read_registry_content\" in identity[\"roles\"] && request[\"type\"] == \"repository\" && request[\"action\"] == \"pull\""
        }
      }
    }
  }
  request_ip_acl = {
    allow_cidrs = ["192.0.2.0/24", "2001:db8::/32"]
    deny_cidrs  = ["192.0.2.128/25"]
  }
}

​

Schema

​

Required

• namespace (String) Parent namespace name, such as example-images. Changing it replaces this policy resource.

​

Optional

• policy_sets (Attributes Map) Authoritative policy sets keyed by stable IDs. Omitted entries are removed. COREWEAVE_KUBERNETES is deprecated; use WORKLOAD_FEDERATION. (see below for nested schema)
• request_ip_acl (Attributes) Optional request filter. At least one allow or deny network is required; omission removes the ACL. An ACL grants no authorization. (see below for nested schema)
• timeouts (Attributes) (see below for nested schema)

​

Read-Only

• access_config_state (String) Current access policy rollout state.
• created_at (String) Creation timestamp in RFC3339 format.
• etag (String) Current concurrency token. Changes when the server updates the resource.
• id (String) Canonical API resource name used as the Terraform identifier.
• name (String) Canonical API resource name.
• revision (Number) Current desired policy revision.
• updated_at (String) Last update timestamp in RFC3339 format.

​

Nested Schema for policy_sets

• identity_selector (String) Identity class evaluated by this policy set. Supported values: COREWEAVE, WORKLOAD_FEDERATION, ANY_AUTHENTICATED, ANONYMOUS, COREWEAVE_KUBERNETES. COREWEAVE_KUBERNETES is deprecated; use WORKLOAD_FEDERATION.
• rules (Attributes Map) Authoritative rules keyed by stable IDs. Omitted rules are removed. (see below for nested schema)

​

Nested Schema for policy_sets.rules

• expression (String) CEL expression evaluated against the request identity and context.

​

Nested Schema for request_ip_acl

• allow_cidrs (Set of String) Canonical IPv4 or IPv6 networks; host bits and IPv4-mapped IPv6 are rejected.
• deny_cidrs (Set of String) Canonical IPv4 or IPv6 networks; host bits and IPv4-mapped IPv6 are rejected.

​

Nested Schema for timeouts

• create (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as ”30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours).
• delete (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as ”30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
• read (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as ”30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
• update (String) A string that can be parsed as a duration consisting of numbers and unit suffixes, such as ”30s” or “2h45m”. Valid time units are “s” (seconds), “m” (minutes), “h” (hours).

​

Import

terraform import coreweave_container_registry_access_configuration.images example-images