Azure Container Registry (ACR) Doesn't Have a Retention Policy Set misconfiguration detected in code

Azure Container Registry (ACR) Doesn't Have a Retention Policy Set misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_AZURE_167
Category - Subcategory	Storage - Backups
Provider	AZURE
Severity	LOW
Framework	Terraform, Terraform Plan

Impact

Azure Container Registry retention policies help to manage image storage by automatically deleting untagged manifests. Enabling this policy ensures efficient usage of storage and removes potential vulnerabilities associated with stale or unused images.

This rule checks if the retention policy is enabled for Azure Container Registry, ensuring that untagged manifests are automatically deleted.

How to Fix

Resource: azurerm_container_registry

• Arguments: retention_policy [source,go]

---

resource "azurerm_container_registry" "example" { ...

If using azurerm version below 4.0

• retention_policy {
• enabled = true
• days = 7
• }

If using azurerm version 4.0 and above

• retention_policy_in_days = 7 }

---