last sync: 2020-Oct-30 14:31:57 UTC

Azure Policy definition

Container registries should not allow unrestricted network access

Name Container registries should not allow unrestricted network access
Azure Portal
Id d0793b48-0edc-4296-a390-4c75d1bdfd71
Version 1.0.0
details on versioning
Category Container Registry
Microsoft docs
Description Audit container registries that do not have any network or firewall (IP) rules configured and so allow all network access by default. Restricting network access protects container registries from potential threats. Container registries with at least one IP / firewall rule or configured virtual network are deemed compliant. For more information on Container Registry network rules, visit: https://aka.ms/acr/portal/public-network and https://aka.ms/acr/vnet.
Mode Indexed
Type BuiltIn
Preview FALSE
Deprecated FALSE
Effect Default: Audit
Allowed: (Audit, Disabled)
Used RBAC Role none
History
Date/Time (UTC ymd) (i) Change type Change detail
2020-05-29 15:39:09 change Previous DisplayName: [Preview]: Container Registries should not allow unrestricted network access
2020-02-12 02:52:44 add d0793b48-0edc-4296-a390-4c75d1bdfd71
Used in Initiatives none
Json
{
  "properties": {
    "displayName": "Container registries should not allow unrestricted network access",
    "policyType": "BuiltIn",
    "mode": "Indexed",
    "description": "Audit container registries that do not have any network or firewall (IP) rules configured and so allow all network access by default. Restricting network access protects container registries from potential threats. Container registries with at least one IP / firewall rule or configured virtual network are deemed compliant. For more information on Container Registry network rules, visit: https://aka.ms/acr/portal/public-network and https://aka.ms/acr/vnet.",
    "metadata": {
      "version": "1.0.0",
      "category": "Container Registry"
    },
    "parameters": {
      "effect": {
        "type": "String",
        "metadata": {
          "displayName": "Effect",
          "description": "Enable or disable the execution of the policy"
        },
        "allowedValues": [
          "Audit",
          "Disabled"
        ],
        "defaultValue": "Audit"
      }
    },
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.ContainerRegistry/registries"
          },
          {
            "anyof": [
              {
                "field": "Microsoft.ContainerRegistry/registries/networkRuleSet.defaultAction",
                "exists": "false"
              },
              {
                "field": "Microsoft.ContainerRegistry/registries/networkRuleSet.defaultAction",
                "equals": "Allow"
              }
            ]
          }
        ]
      },
      "then": {
      "effect": "[parameters('effect')]"
      }
    }
  },
  "id": "/providers/Microsoft.Authorization/policyDefinitions/d0793b48-0edc-4296-a390-4c75d1bdfd71",
  "type": "Microsoft.Authorization/policyDefinitions",
  "name": "d0793b48-0edc-4296-a390-4c75d1bdfd71"
}