Control: Container registries should not allow unrestricted network access
Description
Azure container registries by default accept connections over the internet from hosts on any network. To protect your registries from potential threats, allow access from only specific public IP addresses or address ranges. If your registry doesn't have an IP/firewall rule or a configured virtual network, it will appear in the unhealthy resources.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.container_registry_restrict_public_accessSnapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.container_registry_restrict_public_access --shareSQL
This control uses a named query:
select distinct a.name as resource, case when network_rule_set ->> 'defaultAction' = 'Deny' then 'ok' else 'alarm' end as status, case when network_rule_set ->> 'defaultAction' = 'Deny' then a.name || ' publicly not accessible.' else a.name || ' publicly accessible.' end as reason , a.resource_group as resource_group , sub.display_name as subscriptionfrom azure_container_registry as a, azure_subscription as subwhere sub.subscription_id = a.subscription_id;