acr_checklist.en.json

{
    "items": [
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Disable Azure Container Registry image export",
            "description": "Disable image export to prevent data exfiltration. Note that this will prevent image import of images into another ACR instance.",
            "waf": "Security",
            "service": "ACR",
            "guid": "ab91932c-9fc9-4d1b-a880-37f5e6bfcb9e",
            "id": "A01.01",
            "severity": "High",
            "query": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend acrName = name, acrId = id | extend exportPolicyStatus = properties.policies.exportPolicy.status | extend compliant = iif(exportPolicyStatus =~ 'Disabled', true, false) | project acrName, acrId, exportPolicyStatus, compliant",
            "link": "https://learn.microsoft.com/azure/container-registry/data-loss-prevention"
        },
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Enable Azure Policies for Azure Container Registry",
            "description": "Enable audit compliance visibility by enabling Azure Policy for Azure Container Registry",
            "waf": "Security",
            "service": "ACR",
            "guid": "d503547c-d447-4e82-9128-a7100f1cac6d",
            "id": "A01.02",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-azure-policy"
        },
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Sign and Verify containers with notation (Notary v2)",
            "description": "The Azure Key Vault (AKV) is used to store a signing key that can be utilized by?notation?with the notation AKV plugin (azure-kv) to sign and verify container images and other artifacts. The Azure Container Registry (ACR) allows you to attach these signatures using the?az?or?oras?CLI commands.",
            "waf": "Security",
            "service": "ACR",
            "guid": "d345293c-7639-4637-a551-c5c04e401955",
            "id": "A01.03",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-tutorial-sign-build-push"
        },
        {
            "category": "Security",
            "subcategory": "Data Protection",
            "text": "Encrypt registry with a customer managed key",
            "description": "Azure Container Registry automatically encrypts images and other artifacts that you store. By default, Azure automatically encrypts the registry content at rest by using service-managed keys. By using a customer-managed key, you can supplement default encryption with an additional encryption layer.",
            "waf": "Security",
            "service": "ACR",
            "guid": "0bd05dc2-efd5-4d76-8d41-d2500cc47b49",
            "id": "A01.04",
            "severity": "Medium",
            "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend acrName = name, acrId = id | extend encryptionStatus = properties.encryption.status  | extend compliant = iif(encryptionStatus == 'disabled', false, true) | project acrName, acrId, encryptionStatus, compliant",
            "link": "https://learn.microsoft.com/azure/container-registry/tutorial-customer-managed-keys"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Use Managed Identities to connect instead of Service Principals",
            "description": "Use managed identities to secure ACRPull/Push RBAC access from client applications",
            "waf": "Security",
            "service": "ACR",
            "guid": "8f42d78e-79dc-47b3-9bd2-a1a27e7a8e90",
            "id": "A02.01",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Disable local authentication for management plane access",
            "description": "The local Administrator account is disabled by default and should not be enabled. Use either Token or RBAC-based access methods instead",
            "waf": "Security",
            "service": "ACR",
            "guid": "be0e38ce-e297-411b-b363-caaab79b198d",
            "id": "A02.02",
            "severity": "High",
            "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend localAdminDisabled = properties.adminUserEnabled // Adjust this property as needed | extend compliant = iif(localAdminDisabled == 'false', true, false) // Check if local admin is disabled | project compliant, name, id, tags | distinct id, compliant",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication-managed-identity"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Assign AcrPull & AcrPush RBAC roles rather than granting Administrative access to identity principals",
            "description": "Disable Administrator account and assign RBAC roles to principals for ACR Pull/Push operations",
            "waf": "Security",
            "service": "ACR",
            "guid": "387e5ced-126c-4d13-8af5-b20c6998a646",
            "id": "A02.03",
            "severity": "High",
            "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend localAdminDisabled = properties.adminUserEnabled // Adjust this property as needed | extend compliant = iif(localAdminDisabled == 'false', true, false) // Check if local admin is disabled | project compliant, name, id, tags | distinct id, compliant",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-roles?tabs=azure-cli"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Disable Anonymous pull access",
            "description": "Disable anonymous pull/push access",
            "waf": "Security",
            "service": "ACR",
            "guid": "e338997e-41c7-47d7-acf6-a62a1194956d",
            "id": "A02.04",
            "severity": "Medium",
            "graph": "resources | where type =~ 'microsoft.containerregistry/registries' | extend compliant = iif(properties.anonymousPullEnabled == false, true, false) | project compliant, name, id, tags | distinct id, compliant",
            "link": "https://learn.microsoft.com/azure/container-registry/anonymous-pull-access#configure-anonymous-pull-access"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Disable repository-scoped access tokens",
            "description": "Token authentication doesn't support assignment to an AAD principal. Any tokens provided are able to be used by anyone who can access the token",
            "waf": "Security",
            "service": "ACR",
            "guid": "698dc3a2-fd27-4b2e-8870-1a1252beedf6",
            "id": "A02.05",
            "severity": "High",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-authentication?tabs=azure-cli"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Deploy images from a trusted environment",
            "description": "Deploy container images to an ACR behind a Private endpoint within a trusted network",
            "waf": "Security",
            "service": "ACR",
            "guid": "b3bec3d4-f343-47c1-936d-b55f27a71eee",
            "id": "A02.06",
            "severity": "High"
        },
        {
            "category": "Security",
            "subcategory": "Identity and Access Control",
            "text": "Disable Azure ARM audience tokens for authentication",
            "description": "Only tokens with an ACR audience can be used for authentication. Used when enabling Conditional access policies for ACR",
            "waf": "Security",
            "service": "ACR",
            "guid": "3a041fd3-2947-498b-8288-b3c6a56ceb54",
            "id": "A02.07",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-enable-conditional-access-policy"
        },
        {
            "category": "Security",
            "subcategory": "Logging and Monitoring",
            "text": "Enable diagnostics logging",
            "description": "Set up a diagnostic setting to send 'repositoryEvents' & 'LoginEvents' to Log Analytics as the central destination for logging and monitoring. This allows you to monitor control plane activity on the ACR resource itself.",
            "waf": "Security",
            "service": "ACR",
            "guid": "8a488cde-c486-42bc-9bd2-1be77f26e5e6",
            "id": "A03.01",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/container-registry/monitor-service"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Control inbound network access with Private Link",
            "description": "Service supports disabling public network access either through using service-level IP ACL filtering rule (not NSG or Azure Firewall) or using a 'Disable Public Network Access' toggle switch",
            "waf": "Security",
            "service": "ACR",
            "guid": "21d41d25-00b7-407a-b9ea-b40fd3290798",
            "id": "A04.01",
            "severity": "Medium",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-private-link"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Disable Public Network access",
            "description": "Disable public network access if inbound network access is secured using Private Link",
            "waf": "Security",
            "service": "ACR",
            "guid": "cd289ced-6b17-4db8-8554-62f2aee4553a",
            "id": "A04.02",
            "severity": "Medium",
            "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | where sku.name =~ 'Premium' // Check for Premium SKU | extend publicAccessEnabled = properties.publicNetworkAccess | extend defaultAction = tostring(properties.networkRuleSet.defaultAction) // Extract defaultAction | extend compliant = iif(publicAccessEnabled != 'Enabled' or defaultAction == 'Deny', true, false) | project name, id, publicAccessEnabled, defaultAction, compliant",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-access-selected-networks#disable-public-network-access"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Use an Azure Container Registry SKU that supports Private Link (Premium SKU)",
            "description": "Only the ACR Premium SKU supports Private Link access",
            "waf": "Security",
            "service": "ACR",
            "guid": "fc833934-8b26-42d6-ac5f-512925498f6d",
            "id": "A04.03",
            "severity": "Medium",
            "graph": "resources | where type =~ 'Microsoft.ContainerRegistry/registries' | extend skuName = sku.name // Extract the SKU name | extend compliant = iif(skuName == 'Premium', true, false) // Check if SKU is Premium | project name, id, skuName, compliant",
            "link": "https://learn.microsoft.com/azure/container-registry/container-registry-skus"
        },
        {
            "category": "Security",
            "subcategory": "Network Security",
            "text": "Enable Defender for Containers to scan Azure Container Registry for vulnerabilities",
            "description": "Azure Defender for containers or equivalent service should be used to scan container images for vulnerabilities",
            "waf": "Security",
            "service": "ACR",
            "guid": "bad37dac-43bc-46ce-8d7a-a9b24604489a",
            "id": "A04.04",
            "severity": "Low",
            "link": "https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction"
        },
        {
            "category": "Security",
            "subcategory": "Vulnerability Management",
            "text": "Deploy validated container images",
            "description": "Deploy trusted code that was validated and scanned for vulnerabilities according to DevSecOps practices.",
            "waf": "Security",
            "service": "ACR",
            "guid": "4451e1a2-d345-4293-a763-9637a551c5c0",
            "id": "A05.01",
            "severity": "Medium"
        },
        {
            "category": "Security",
            "subcategory": "Vulnerability Management",
            "text": "Use up-to-date platforms, languages, protocols and frameworks",
            "description": "Use the latest versions of supported platforms, programming languages, protocols, and frameworks.",
            "waf": "Security",
            "service": "ACR",
            "guid": "4e401955-387e-45ce-b126-cd132af5b20c",
            "id": "A05.02",
            "severity": "High"
        }
    ],
    "categories": [
        {
            "name": "Security"
        },
        {
            "name": "Network topology and connectivity"
        },
        {
            "name": "Operations management"
        },
        {
            "name": "Platform Automation"
        },
        {
            "name": "Security"
        },
        {
            "name": "Ledger"
        },
        {
            "name": "Logging"
        },
        {
            "name": "Networking"
        },
        {
            "name": "Data Discovery and Classification"
        },
        {
            "name": "Data Masking"
        },
        {
            "name": "Code"
        }
    ],
    "waf": [
        {
            "name": "Reliability"
        },
        {
            "name": "Security"
        },
        {
            "name": "Cost"
        },
        {
            "name": "Operations"
        },
        {
            "name": "Performance"
        }
    ],
    "yesno": [
        {
            "name": "Yes"
        },
        {
            "name": "No"
        }
    ],
    "status": [
        {
            "name": "Not verified",
            "description": "This check has not been looked at yet"
        },
        {
            "name": "Open",
            "description": "There is an action item associated to this check"
        },
        {
            "name": "Fulfilled",
            "description": "This check has been verified, and there are no further action items associated to it"
        },
        {
            "name": "N/A",
            "description": "Not applicable for current design"
        },
        {
            "name": "Not required",
            "description": "Not required"
        }
    ],
    "severities": [
        {
            "name": "High"
        },
        {
            "name": "Medium"
        },
        {
            "name": "Low"
        }
    ],
    "metadata": {
        "name": "Azure Container Registry Security Review",
        "waf": "security",
        "state": "Preview",
        "timestamp": "October 23, 2024"
    }
}