How to secure Azure Container Registry?

Azure Container Registry (ACR) is a managed, private Docker registry service that stores and manages your container images in Azure.

Below are the few recommendations for using Azure Container Registry.

• Image scanning with Azure Security Center

With Azure Security Center, you can get automatic scans of your registries for any threats and vulnerabilities of the images. Note if you're on Azure Security Center's standard tier, you can add the Container Registries bundle. This feature is charged per image scan. Whenever an new image is pushed to your registry, Security Center automatically scans that image. Azure Security Center also provide options or recommendations for resolving those vulnerabilities.

• Enable Content Trust

Azure Container Registry implements Docker's content trust model, enabling pushing and pulling of signed images. Content trust helps to verify the source and integrity of the images, ensuring that they are the images we expect. As an image publisher, content trust allows you to sign the images you push to your registry. Consumers of your images (people or systems pulling images from your registry) can configure their clients to pull only signed images. 

• Authorize using Managed Identity and disabling Admin account

As we are aware support for managed identities available for several Azure resources like Key vault, Web Apps, Azure functions etc. similarly option is available for Azure Container Registry.Use a managed identity for Azure resources to authenticate to an Azure container registry from another Azure resource, without needing to provide or manage registry credentials. Whether its System Assigned or User Assigned Managed Identity, ACR supports it.

Additionally you can use an Azure Active Directory (Azure AD) service principal to provide access to your private container registries in Azure Container Registry

Disable the Admin Account on your Container Registry, which is disabled by default. The admin account is designed for a single user to access the registry, mainly for testing purposes. Individual identity is recommended to trace activity on Azure Container Registry

• Enable Activity Logs for your Container Registry

With the Azure Container Registry, we can get audit log in the "Activity log" menu option in the Azure Portal. Reviewing these logs regularly can helps organisation/teams to explore suspicious and anomalous activity.

• Role-Based Access Control

Azure Container Registry supports a set of built-in Azure roles that provide different levels of permissions to an Azure container registry. Use RBAC to assign specific permissions to users, service principals, or other identities that need to interact with a registry.

Assign the Reader role to identities/users/principals who needs to only pull images

• Firewall

With a virtual network or firewall rule in place, you can control the entire traffic flow. 

• Limit access to a registry by assigning virtual network private IP addresses to the registry endpoints using Azure Private Link.
• Additionally you can restrict access to a container registry using a service endpoint in an Azure virtual network

• Repository scoped permissions (Preview)

This enables fine grained control of access to your ACR. For a use case that have multiple images, where different access control is required at repository level instead of providing access to entire registry can be done using scoped permission. With this you can provide an external organization with permissions to a specific repository.This feature is only available in a Premium container registry and still in Preview feature.

• Encrypt with Customer-Managed Key

This feature enables automatically encrypts the registry content at rest with service-managed keys. This feature is currently in preview and enable as part of creating registry.

Note: Content trust is currently not supported in a registry encrypted with a customer-managed key

References

Content trust Docker

Azure Container Registry 

Encrypt Registry Data