Vulnerability Scanning not enabled for Azure Container Registry misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_163
Category - Subcategory	Public Exposure - Encryption And Protocols
Provider	AZURE
Severity	MEDIUM
Framework	ARM, Bicep, Terraform, Terraform Plan

Impact

Vulnerability scanning for container images is a critical security feature that helps to identify software flaws in your container images. It is highly recommended to enable this feature in Azure Container Registry to identify and fix vulnerabilities before they can be exploited.

This rule checks whether the Azure Container Registry has vulnerability scanning enabled by requiring a SKU of Standard or Premium.

How to Fix

Resource: azurerm_container_registry

• Arguments: sku

// Note: Vulnerability scanning is only available for 'Standard' or 'Premium' SKUs. [source,go]

resource "azurerm_container_registry" "example" { name = "exampleContainerRegistry" resource_group_name = azurerm_resource_group.example.name location = azurerm_resource_group.example.location

• sku = "Standard" admin_enabled = false }

---