Back to Checks
azure

Subscription has container image vulnerability scanning enabled

defender_container_images_scan_enabled
Service: defenderSeverity: high
OfficialBuilt-inVerified
Categories:vulnerabilitiescontainer-security
Resource Type:microsoft.security/pricings

Azure subscriptions have container image vulnerability assessment enabled for Azure Container Registry via Microsoft Defender for Cloud (ContainerRegistriesVulnerabilityAssessments). Images in registries are evaluated for known package vulnerabilities in their packages and dependencies.

Prowler logoProwlerprowler-provider-azure

Risk

Without registry scanning, known CVEs in images can reach runtime, enabling RCE, privilege escalation, and lateral movement. This undermines data confidentiality and integrity and can reduce availability through cryptomining or service disruption.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler azure --checks defender_container_images_scan_enabled

Recommendation

Enable Defender for Cloud image assessment for registries and adopt shift-left scanning.

  • Block deployment of images with high-severity findings
  • Rebuild from patched base images regularly
  • Enforce least privilege on registry access
  • Use image signing and admission controls

Remediation

CLI

az rest --method put --url https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Security/pricings/Containers?api-version=2023-01-01 --body '{"properties":{"pricingTier":"Standard","extensions":[{"name":"ContainerRegistriesVulnerabilityAssessments","isEnabled":true}]}}'

Terraform

# Enable Defender for Containers with container registry vulnerability scanning
resource "azurerm_security_center_subscription_pricing" "<example_resource_name>" {
  tier          = "Standard"
  resource_type = "Containers"
  
  extension {
    name = "ContainerRegistriesVulnerabilityAssessments"  # CRITICAL: enables ACR image vulnerability scanning
  }
}

NativeIaC

// Enable Defender for Containers image vulnerability scanning at subscription scope
targetScope = 'subscription'

resource containersPricing 'Microsoft.Security/pricings@2023-01-01' = {
  name: 'Containers'
  properties: {
    pricingTier: 'Standard'
    extensions: [
      {
        name: 'ContainerRegistriesVulnerabilityAssessments' // CRITICAL: enables ACR image vulnerability scanning
        isEnabled: true                                   // CRITICAL: turns the extension ON
      }
    ]
  }
}

Other

1In Azure Portal, open Microsoft Defender for Cloud
2Go to Environment settings and select your subscription
3Open Settings (or Defender plans)
4Find Containers and set Plan to On/Standard
5Enable Container registries vulnerability assessments
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_Azure
from prowler.providers.azure.services.defender.defender_client import defender_client


class defender_container_images_scan_enabled(Check):
    def execute(self) -> Check_Report_Azure:
        findings = []
        for subscription, pricings in defender_client.pricings.items():
            subscription_name = defender_client.subscriptions.get(
                subscription, subscription
            )
            if "Containers" in pricings:
                report = Check_Report_Azure(
                    metadata=self.metadata(), resource=pricings["Containers"]
                )
                report.subscription = subscription
                report.status = "PASS"
                report.status_extended = f"Container image scan is enabled in subscription {subscription_name} ({subscription})."
                if not pricings["Containers"].extensions.get(
                    "ContainerRegistriesVulnerabilityAssessments"
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Container image scan is disabled in subscription {subscription_name} ({subscription})."

                findings.append(report)
        return findings

References