Artifact Registry "denied: Permission artifactregistry.repositories.uploadArtifacts" in CI

By Kaveh Alemi·Latchkey

docker push authenticated to Artifact Registry but the identity is not allowed to write to that repository. The push is rejected with uploadArtifacts denied; authentication succeeded, authorization did not.

What this error means

docker push to *-docker.pkg.dev fails with "denied: Permission 'artifactregistry.repositories.uploadArtifacts' denied on resource ...".

denied: Permission "artifactregistry.repositories.uploadArtifacts" denied on resource
"projects/my-project/locations/us-central1/repositories/app" (or it may not exist)

Common causes

The identity lacks the Artifact Registry Writer role

Pushing needs roles/artifactregistry.writer on the repository or project. A reader-only or unrelated role cannot upload artifacts.

Docker is not configured to auth to the registry host

Without gcloud auth configure-docker for the host, the push uses no valid credentials and is denied.

How to fix it

Grant the Writer role on the repository

1. Bind roles/artifactregistry.writer to the CI service account on the repo or project.
2. Configure Docker auth for the registry host.
3. Retry the push.

gcloud artifacts repositories add-iam-policy-binding app \
  --location us-central1 \
  --member="serviceAccount:ci@my-project.iam.gserviceaccount.com" \
  --role="roles/artifactregistry.writer"

Configure Docker for the registry host

Register the Artifact Registry host as a Docker credential helper before pushing.

gcloud auth configure-docker us-central1-docker.pkg.dev

How to prevent it

• Grant artifactregistry.writer to the push identity, reader to the pull identity.
• Run gcloud auth configure-docker <host> before any push step.
• Use Workload Identity Federation instead of long-lived keys for pushes.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation