Which Security policies to implement for Azure Container registry

Question

Please advise if there is a built-in Azure policy initiative for Azure container registry that we can use. We are looking to put Azure policies in place for ACR that align with WAF. What would be the considerations for this? Is there a security baseline recommended by Microsoft for ACR?

Answer 1

Hi @curious7

Microsoft provides a comprehensive security baseline for Azure Container Registry, which aligns with the Microsoft Cloud Security Benchmark. This baseline includes recommendations on network security, identity management, and privileged access. You can monitor compliance with these recommendations using Microsoft Defender for Cloud.

References:
https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/container-registry-security-baseline

https://learn.microsoft.com/en-us/azure/container-registry/container-registry-azure-policy

---

If this answers your question, please click Accept Answer and Yes if this answer was helpful. Doing so would help other community members with similar issues identify the solution. I highly appreciate your contribution to the community.

Answer 2

@curious7 Yes, there are built-in Azure Policy initiatives for Azure Container Registry (ACR) that you can use to enhance security and compliance.

You can find built-in policies for ACR here: https://learn.microsoft.com/en-us/azure/container-registry/policy-reference

Here are some key built-in policies for ACR:

1. Container Registry should be Zone Redundant: Ensures that your container registry is configured for zone resilience, reducing the risk of downtime during zone outages.
2. Container Registry should use a virtual network service endpoint: Audits any container registry not configured to use a virtual network service endpoint.
3. Azure registry container images should have vulnerabilities resolved: Scans your registry for commonly known vulnerabilities (CVEs) and provides a detailed vulnerability report for each image.
4. Configure container registries to disable anonymous authentication: Disables anonymous pull for your registry, ensuring that only authenticated users can access the data.
5. Configure container registries to disable ARM audience token authentication: Ensures that only tokens meant for usage on the registry can be used for authentication.

In addition to the answer above, when aligning Azure policies for ACR with Web Application Firewall (WAF) policies, consider the following:

-Ensure that your ACR is integrated with virtual networks and private endpoints to restrict access.

-Enable logging and monitoring to track access and changes to the registry. Use Azure Monitor and Azure Security Center for comprehensive monitoring.

Let me know if you have any questions in the comments.