Microsoft AzureOverview
Container registries should use private endpoints where possible to minimize internet exposure.
Remediation guidance
Azure Remediation
Service-Wide (Recommended)
Use Azure Policy to enforce private endpoint patterns and restrict public network access.
Azure Portal (Asset-Level)
- Open Container Registry.
- Go to Networking.
- Set public network access to Disabled.
- Configure Private Endpoint connectivity.
Azure CLI (Asset-Level)
az acr update --name <acr-name> --resource-group <resource-group> --public-network-enabled false
References
- https://learn.microsoft.com/en-us/azure/container-registry/container-registry-private-link
Query logic
These are the stored checks tied to this control.
Container registries with public network enabled
Connectors
Microsoft Azure
Covered asset types
ContainerRegistry
Expected check: eq []
{ containerRegistries(where: { OR: [ { publicNetworkAccess_NOT: "Disabled" }, { networkRuleBypassOptions_INCLUDES: "AzureServices" } ] }) { ...AssetFragment } }
