Skip to content

Commit 57fe5ca

Browse files
CopilotBernieWhite
Copilot
and
BernieWhite
committed
Add Azure.ACR.Logs rule for Container Registry audit logs
Co-authored-by: BernieWhite <13513058+BernieWhite@users.noreply.github.com>
1 parent 6495011 commit 57fe5ca

File tree

6 files changed

+433
-28
lines changed

6 files changed

+433
-28
lines changed

‎docs/changelog.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,9 @@ What's changed since v1.45.2:
4545
- Includes rules released before or during September 2025.
4646
- Marked `Azure.GA_2025_06` and `Azure.Preview_2025_06` baselines as obsolete.
4747
- New rules:
48+
- Azure Container Registry:
49+
- Check that audit diagnostic logs are enabled for Container Registry by @copilot.
50+
[#3536](https://github.com/Azure/PSRule.Rules.Azure/issues/3536)
4851
- Azure Cache for Redis:
4952
- Check that Entra ID is required for all authentication of cache instances by @BernieWhite.
5053
[#3113](https://github.com/Azure/PSRule.Rules.Azure/issues/3113)

‎docs/en/rules/Azure.ACR.Logs.md‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
---
2+
severity: Important
3+
pillar: Security
4+
category: SE:10 Monitoring and threat detection
5+
resource: Container Registry
6+
resourceType: Microsoft.ContainerRegistry/registries,Microsoft.Insights/diagnosticSettings
7+
online version: https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.ACR.Logs/
8+
---
9+
10+
# Audit Container Registry access
11+
12+
## SYNOPSIS
13+
14+
Ensure container registry audit diagnostic logs are enabled.
15+
16+
## DESCRIPTION
17+
18+
Azure Container Registry (ACR) provides diagnostic logs that can be used to monitor and audit access to container images.
19+
Enabling audit logs helps you track who accesses your registry and when, which is important for security and compliance.
20+
21+
The following log categories should be enabled:
22+
23+
- `ContainerRegistryLoginEvents` - Captures authentication events to the registry.
24+
- `ContainerRegistryRepositoryEvents` - Captures push and pull operations for container images.
25+
26+
Alternatively, you can enable the `audit` or `allLogs` category group to capture these and other audit events.
27+
28+
## RECOMMENDATION
29+
30+
Consider configuring diagnostic settings to capture container registry audit logs for security investigation.
31+
32+
## EXAMPLES
33+
34+
### Configure with Azure template
35+
36+
To deploy container registries that pass this rule:
37+
38+
- Deploy a diagnostic settings sub-resource (extension resource).
39+
- Enable `ContainerRegistryLoginEvents` and `ContainerRegistryRepositoryEvents` categories or `audit` category group or `allLogs` category group.
40+
41+
For example:
42+
43+
```json
44+
{
45+
"type": "Microsoft.ContainerRegistry/registries",
46+
"apiVersion": "2023-11-01-preview",
47+
"name": "[parameters('name')]",
48+
"location": "[parameters('location')]",
49+
"sku": {
50+
"name": "Premium"
51+
},
52+
"properties": {
53+
"adminUserEnabled": false,
54+
"policies": {
55+
"quarantinePolicy": {
56+
"status": "enabled"
57+
}
58+
}
59+
},
60+
"resources": [
61+
{
62+
"type": "Microsoft.Insights/diagnosticSettings",
63+
"apiVersion": "2021-05-01-preview",
64+
"scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
65+
"name": "logs",
66+
"properties": {
67+
"workspaceId": "[parameters('workspaceId')]",
68+
"logs": [
69+
{
70+
"category": "ContainerRegistryLoginEvents",
71+
"enabled": true
72+
},
73+
{
74+
"category": "ContainerRegistryRepositoryEvents",
75+
"enabled": true
76+
}
77+
]
78+
},
79+
"dependsOn": [
80+
"[parameters('name')]"
81+
]
82+
}
83+
]
84+
}
85+
```
86+
87+
### Configure with Bicep
88+
89+
To deploy container registries that pass this rule:
90+
91+
- Deploy a diagnostic settings sub-resource (extension resource).
92+
- Enable `ContainerRegistryLoginEvents` and `ContainerRegistryRepositoryEvents` categories or `audit` category group or `allLogs` category group.
93+
94+
For example:
95+
96+
```bicep
97+
resource registry 'Microsoft.ContainerRegistry/registries@2023-11-01-preview' = {
98+
name: name
99+
location: location
100+
sku: {
101+
name: 'Premium'
102+
}
103+
properties: {
104+
adminUserEnabled: false
105+
policies: {
106+
quarantinePolicy: {
107+
status: 'enabled'
108+
}
109+
}
110+
}
111+
}
112+
113+
resource logs 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
114+
name: 'logs'
115+
scope: registry
116+
properties: {
117+
workspaceId: workspaceId
118+
logs: [
119+
{
120+
category: 'ContainerRegistryLoginEvents'
121+
enabled: true
122+
}
123+
{
124+
category: 'ContainerRegistryRepositoryEvents'
125+
enabled: true
126+
}
127+
]
128+
}
129+
}
130+
```
131+
132+
Alternatively, you can use category groups:
133+
134+
```bicep
135+
resource logs 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
136+
name: 'logs'
137+
scope: registry
138+
properties: {
139+
workspaceId: workspaceId
140+
logs: [
141+
{
142+
categoryGroup: 'audit'
143+
enabled: true
144+
}
145+
]
146+
}
147+
}
148+
```
149+
150+
## LINKS
151+
152+
- [SE:10 Monitoring and threat detection](https://learn.microsoft.com/azure/well-architected/security/monitor-threats)
153+
- [LT-4: Enable logging for security investigation](https://learn.microsoft.com/security/benchmark/azure/baselines/container-registry-security-baseline#lt-4-enable-logging-for-security-investigation)
154+
- [Monitor Azure Container Registry](https://learn.microsoft.com/azure/container-registry/monitor-container-registry)
155+
- [Container Registry resource logs](https://learn.microsoft.com/azure/container-registry/monitor-container-registry-reference#resource-logs)
156+
- [Azure deployment reference](https://learn.microsoft.com/azure/templates/microsoft.containerregistry/registries)

‎src/PSRule.Rules.Azure/en/PSRule-rules.psd1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@
7676
VMSSPublicKey = "The virtual machine scale set '{0}' should have password authentication disabled."
7777
ACRSoftDeletePolicy = "The container registry '{0}' should have soft delete policy enabled."
7878
ACRSoftDeletePolicyRetention = "The container registry '{0}' should have retention period value between one to 90 days for the soft delete policy."
79+
ContainerRegistryAuditDiagnosticSetting = "Minimum one diagnostic setting should have ({0}) configured or category group ({1}) configured."
7980

8081
AppConfigStoresDiagnosticSetting = "Minimum one diagnostic setting should have ({0}) configured or category group ({1}) configured."
8182
AppConfigPurgeProtection = "The app configuration store '{0}' should have purge protection enabled."

‎src/PSRule.Rules.Azure/rules/Azure.ACR.Rule.ps1‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,24 @@ Rule 'Azure.ACR.ReplicaLocation' -Ref 'AZR-000494' -Type 'Microsoft.ContainerReg
7575
}
7676
}
7777

78+
# Synopsis: Ensure container registry audit diagnostic logs are enabled.
79+
Rule 'Azure.ACR.Logs' -Ref 'AZR-000498' -Type 'Microsoft.ContainerRegistry/registries' -Tag @{ release = 'GA'; ruleSet = '2025_12'; 'Azure.WAF/pillar' = 'Security'; } -Labels @{ 'Azure.MCSB.v1/control' = 'LT-4'; 'Azure.WAF/maturity' = 'L1'; } {
80+
$logCategoryGroups = 'audit', 'allLogs'
81+
$joinedLogCategoryGroups = $logCategoryGroups -join ', '
82+
$diagnostics = @(GetSubResources -ResourceType 'Microsoft.Insights/diagnosticSettings', 'Microsoft.ContainerRegistry/registries/providers/diagnosticSettings' |
83+
ForEach-Object { $_.properties.logs |
84+
Where-Object {
85+
($_.category -in 'ContainerRegistryLoginEvents', 'ContainerRegistryRepositoryEvents' -or $_.categoryGroup -in $logCategoryGroups) -and $_.enabled
86+
}
87+
})
88+
89+
$Assert.Greater($diagnostics, '.', 0).Reason(
90+
$LocalizedData.ContainerRegistryAuditDiagnosticSetting,
91+
'ContainerRegistryLoginEvents, ContainerRegistryRepositoryEvents',
92+
$joinedLogCategoryGroups
93+
).PathPrefix('resources')
94+
}
95+
7896
#endregion Rules
7997

8098
#region Helper functions

0 commit comments

Comments
 (0)