Permission "artifactregistry.repositories.uploadArtifacts" denied on resource "projects/xxx/..."

Google Cloud Compute Infrastructure
1

I am trying to setup a repository in Artifact Registry and push an image to it from my local workstation (or cloud shell). I have done:

  • gcloud init
  • gcloud auth configure-docker us-west3-docker.pkg.dev
  • docker tag my-image us-west3-docker.pkg.dev/my-project/my-repo/my-image:latest
  • docker push us-west3-docker.pkg.dev/my-project/my-repo/my-image:latest

docker push responds with the following error:

denied: Permission “artifactregistry.repositories.uploadArtifacts” denied on resource “projects/my-project/locations/us-west3/repositories/my-repo” (or it may not exist)

When I run gcloud projects get-ancestors-iam-policy my-project, I see that my user principal has both the roles/artifactregistry.repoAdmin and roles/artifactregistry.writer bound. Just to be safe, I ran gcloud artifacts repositories add-iam-policy-binding my-repo --location=us-west3 --member=user:my-email@gmail.com --role=roles/artifactregistry.writer to ensure that I had the permission bound directly to the repository. But I still get this error every time.

I have also tried the IAM policy troubleshooter and it shows that I should also have access to this resource. At this point, I have run out of ideas to check. Any thoughts?

image.png
image.png1194×460 56.3 KB

5 Likes
2

I finally got something to work, but it was not what I expected. I was able to use:

gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin https://us-west3-docker.pkg.dev

followed by the docker push

This might mean that the problem wasn’t with my account permissions but rather the docker <=> gcloud authentication integration.

12 Likes
3

Thanks so much for posting this solution. It worked for me. I was getting nowhere trying to fix this issue by addressing permissions in the GCP console. …zig

4

Thank you so much! I was blocked by this for a number of very frustrating hours and your solution saved me. Thanks!

5

could you please tell me how to push docker image to google artifact registry from terminal on GCP

6

saved my day, thank you !

7

I had the same problem, and it turned out it was because docker, when run with sudo, looks for credentials in /root/.docker instead of ~/.docker. I fixed the issue by running sudo usermod -aG docker $USER, logging out of my computer & back in, and then running docker push without sudo.

See this note from https://cloud.google.com/artifact-registry/docs/docker/authentication: “Note: If you normally run Docker commands on Linux with sudo, Docker looks for Artifact Registry credentials in /root/.docker/config.json instead of $HOME/.docker/config.json. If you want to use sudo with docker commands instead of using the Docker security group, configure credentials with sudo gcloud auth configure-docker instead.”

7 Likes
8

The same problem occurred on the windows platform I used. After two days of troubleshooting, I found that I installed the windows version of gcloud and pushed the image in wsl. This problem occurred. Currently, I uninstalled the windows sdk and installed it. With the linux version of gcloud, all problems are solved. I hope it can help anyone.

1 Like
9

I granted some permissions to ****@cloudbuild.gserviceaccount.com, i.e to cloud build service account that was provided by Google itself. Then it finally worked for me

10

Great…this helped with my issue where error was below and I was trying to perform docker push with sudo:
denied: Unauthenticated request. Unauthenticated requests do not have permission “artifactregistry.repositories.uploadArtifacts” on resource “projects/[PROJECT-ID]/locations/us/repositories/gcr.io” (or it may not exist)

11

Hi all,

I have similar issue and do not know how to fix it.

In my case, I do not user docker commands to push the image. I just let the Cloud Build to recognize the language and build the image (golang) with the following command:

gcloud builds submit --pack image=europe-west3-docker.pkg.dev/xxxxxxx/yyyyy,env=PORT=8181

Cloud Build recognized the golang package, compiles the code, builds the image (with no issues) but at the final stage when trying to push the image to the registry I got the error message:

denied: Permission “artifactregistry.repositories.uploadArtifacts” denied on resource “projects/ …” (or it may not exist).

Thank you in advance for you help.

12

I solved my issue. The services account of the Cloud Build process requires additional “Artifact Registry Writer” role. :slightly_smiling_face:

13

Even after adding a permission and login with gcloud auth print-access-token | docker login -u oauth2accesstoken --password-stdin https://us-west3-docker.pkg.dev still not working.
getting error
denied: Unauthenticated request. Unauthenticated requests do not have permission “artifactregistry.repositories.uploadArtifacts” on resource “projects/user-stores-project/locations/asia-south1/repositories/store-service-repo” (or it may not exist).

could anyone please help me out

14

in my case I had to add sudo to @svoid command as I was running push with super user

15

If you’re using cloud-build, giving the IAM role Artifact Registry Writer to the cloud build service account works. Although, the preferred cloud-build service account is ${project_num}-compute@developer.gserviceaccount.com and not the legacy ${prject_num}@cloudbuild.gserviceaccount.com

1 Like
16

Thank you, it helps a lot!

17

any solution for this ???

denied: Unauthenticated request. Unauthenticated requests do not have permission “artifactregistry.repositories.uploadArtifacts” on resource

18

I could kiss you, thank you!

19

I was trying everything that I could find on similar posts, but in my case, all I had to do was run

sudo gcloud auth login

(the sudo is important)

and I also ran

sudo gcloud auth configure-docker us-east1-docker.pkg.dev (sudo is also important)

and then I could finally push and pull images from the artifact registry (using sudo)

20

OMG YOU ARE AN ANGEL!