Back to Checks
azure

Container Registry public network access is disabled

containerregistry_not_publicly_accessible
Service: containerregistrySeverity: high
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:microsoft.containerregistry/registries

Azure Container Registry configuration indicates whether the registry permits unrestricted public access based on the Public network access setting.

Prowler logoProwlerprowler-provider-azure

Risk

Internet-exposed ACR expands attack paths impacting CIA:

  • Confidentiality: unauthorized image pulls leak code/secrets
  • Integrity: compromised creds allow tampered image pushes (supply-chain)
  • Availability: pull storms or scans exhaust quotas, causing outages and cost spikes

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks containerregistry_not_publicly_accessible

Recommendation

Set Public network access to Disabled and use Private Link for registry access.

If public reachability is required, allow only selected IPs, enforce least privilege and token rotation, and apply defense in depth (egress control, network segmentation, logging of push/pull events).

Remediation

CLI

az acr update --name <registry-name> --public-network-enabled false

Terraform

resource "azurerm_container_registry" "<example_resource_name>" {
  name                = "<example_resource_name>"
  resource_group_name = "<example_resource_name>"
  location            = "<location>"
  sku                 = "Basic"

  public_network_access_enabled = false # Critical: disables public endpoint to block unrestricted access
}

NativeIaC

// Azure Container Registry with public network access disabled
resource <example_resource_name> 'Microsoft.ContainerRegistry/registries@2025-11-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  sku: {
    name: 'Basic'
  }
  properties: {
    publicNetworkAccess: 'Disabled' // Critical: disables the public endpoint to prevent unrestricted access
  }
}

Other

1In the Azure portal, go to your Container Registry
2Select Settings > Networking
3On Public access, set Allow public network access to Disabled
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.containerregistry.containerregistry_client import (
    containerregistry_client,
)


class containerregistry_not_publicly_accessible(Check):
    def execute(self) -> list[Check_Report_Azure]:
        findings = []

        for subscription, registries in containerregistry_client.registries.items():
            subscription_name = containerregistry_client.subscriptions.get(
                subscription, subscription
            )
            for container_registry_info in registries.values():
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=container_registry_info
                )
                report.subscription = subscription
                report.status = "FAIL"
                report.status_extended = f"Container Registry {container_registry_info.name} from subscription {subscription_name} ({subscription}) allows unrestricted network access."

                if not container_registry_info.public_network_access:
                    report.status = "PASS"
                    report.status_extended = f"Container Registry {container_registry_info.name} from subscription {subscription_name} ({subscription}) does not allow unrestricted network access."

                findings.append(report)

        return findings

References