> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt
> Use this file to discover all available pages before exploring further.

# coreweave_container_registry_access_configuration (Resource)

Authoritatively manages the complete Container Registry access configuration. Omitted entries are removed. Use one owner per namespace; avoid concurrent changes from the console, CLI or another Terraform resource.

Destroy resets access to deny-all and removes the IP ACL. It does not restore an earlier policy. Use `terraform state rm` or a `removed` block with `destroy = false` to relinquish ownership without resetting the policy.

If the parent is not ACTIVE, destroy warns and relinquishes ownership because the API cannot reset the policy. A retained namespace keeps its policy if it later becomes ACTIVE. Parent references establish deletion ordering.

Apply waits until the API reports the desired access revision as accepted. Action deadlines default to 20 minutes.

## Example usage

```terraform theme={"system"}
variable "org_id" {
  type = string
}

resource "coreweave_container_registry_namespace" "images" {
  name                         = "example-images"
  zone                         = "US-LAB-01A"
  initial_access_configuration = {}
}

resource "coreweave_container_registry_access_configuration" "images" {
  namespace = coreweave_container_registry_namespace.images.name
  policy_sets = {
    readers = {
      identity_selector = "COREWEAVE"
      rules = {
        pull = {
          expression = "identity[\"org_id\"] == ${jsonencode(var.org_id)} && \"read_registry_content\" in identity[\"roles\"] && request[\"type\"] == \"repository\" && request[\"action\"] == \"pull\""
        }
      }
    }
  }
  request_ip_acl = {
    allow_cidrs = ["192.0.2.0/24", "2001:db8::/32"]
    deny_cidrs  = ["192.0.2.128/25"]
  }
}
```

## Schema

### Required

* `namespace` (String) Parent namespace name, such as example-images. Changing it replaces this policy resource.

### Optional

* `policy_sets` (Attributes Map) Authoritative policy sets keyed by stable IDs. Omitted entries are removed. COREWEAVE\_KUBERNETES is deprecated; use WORKLOAD\_FEDERATION. (see [below for nested schema](#nestedatt--policy_sets))
* `request_ip_acl` (Attributes) Optional request filter. At least one allow or deny network is required; omission removes the ACL. An ACL grants no authorization. (see [below for nested schema](#nestedatt--request_ip_acl))
* `timeouts` (Attributes) (see [below for nested schema](#nestedatt--timeouts))

### Read-Only

* `access_config_state` (String) Current access policy rollout state.
* `created_at` (String) Creation timestamp in RFC3339 format.
* `etag` (String) Current concurrency token. Changes when the server updates the resource.
* `id` (String) Canonical API resource name used as the Terraform identifier.
* `name` (String) Canonical API resource name.
* `revision` (Number) Current desired policy revision.
* `updated_at` (String) Last update timestamp in RFC3339 format.

<h3 id="nestedatt--policy_sets">
  Nested Schema for `policy_sets`
</h3>

Required:

* `identity_selector` (String) Identity class evaluated by this policy set. Supported values: `COREWEAVE`, `WORKLOAD_FEDERATION`, `ANY_AUTHENTICATED`, `ANONYMOUS`, `COREWEAVE_KUBERNETES`. COREWEAVE\_KUBERNETES is deprecated; use WORKLOAD\_FEDERATION.
* `rules` (Attributes Map) Authoritative rules keyed by stable IDs. Omitted rules are removed. (see [below for nested schema](#nestedatt--policy_sets--rules))

<h3 id="nestedatt--policy_sets--rules">
  Nested Schema for `policy_sets.rules`
</h3>

Required:

* `expression` (String) CEL expression evaluated against the request identity and context.

<h3 id="nestedatt--request_ip_acl">
  Nested Schema for `request_ip_acl`
</h3>

Optional:

* `allow_cidrs` (Set of String) Canonical IPv4 or IPv6 networks; host bits and IPv4-mapped IPv6 are rejected.
* `deny_cidrs` (Set of String) Canonical IPv4 or IPv6 networks; host bits and IPv4-mapped IPv6 are rejected.

<h3 id="nestedatt--timeouts">
  Nested Schema for `timeouts`
</h3>

Optional:

* `create` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
* `delete` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Setting a timeout for a Delete operation is only applicable if changes are saved into state before the destroy operation occurs.
* `read` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours). Read operations occur during any refresh or planning operation when refresh is enabled.
* `update` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).

## Import

Import is supported using the following syntax:

```bash theme={"system"}
terraform import coreweave_container_registry_access_configuration.images example-images
```