Container Registry should use private endpoints

High Azure General acr-private-endpoint

Applies to

Microsoft.ContainerRegistry/registries

What CGPulse checks

A resource passes this rule when privateEndpointConnections.hasConnections must equal true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Add a private endpoint to route traffic privately and eliminate public internet exposure. In Azure Portal: Container Registry > Networking > Private endpoint connections > Add. See: https://learn.microsoft.com/en-us/azure/container-registry/container-registry-private-link

CLI

az network private-endpoint create -g "{rg}" -n "{name}-pe" --vnet-name var.vnet_name --subnet "<subnet-name>" --private-connection-resource-id "{id}" --group-id "registry" --connection-name "{name}-plsc"

Terraform

resource "azurerm_private_endpoint" "acr" {
  name                = "{name}-pe"
  resource_group_name = "{rg}"
  location            = var.location
  subnet_id           = var.subnet_id
  private_service_connection {
    name                           = "{name}-plsc"
    private_connection_resource_id = "{id}"
    subresource_names              = ["registry"]
    is_manual_connection           = false
  }
  # Configure private_dns_zone_group with your existing DNS zone ID
}

Compliance frameworks

Cloud Security BaselineNS-2

Vendor documentation

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan