Container Registry must not allow anonymous pull for asset control

High Azure General acr-container-registry-allow-anonymous

Applies to

Microsoft.ContainerRegistry/registries

What CGPulse checks

A resource passes this rule when anonymousPullEnabled must equal false. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Disable anonymous pull to ensure all image consumers are identified and tracked. In Azure Portal: Container Registry > Properties > set Anonymous pull enabled to Disabled. See: https://learn.microsoft.com/en-us/azure/container-registry/anonymous-pull-access

CLI

az acr update --ids "{id}" --anonymous-pull-enabled false

Terraform

resource "azurerm_container_registry" "{name}" {
  anonymous_pull_enabled = false
}

Compliance frameworks

Critical Security Controls v81.2

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan