Minimize and scope access to Azure Container Registry (ACR)

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Review ACR access for AKS Automatic to confirm the registry uses least privilege, identity based access. Verify the ACR admin account is disabled, determine whether the registry is using RBAC only or RBAC + ABAC, confirm the AKS kubelet identity has only image pull rights, and review other principals for unnecessary push, delete, or broader registry permissions. • Confirm that adminUserEnabled is false, since the local admin account provides broad registry access and is not the preferred authentication method for integrated AKS and ACR use.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Disable the ACR local admin account and use identity based, least privilege access for registry authentication and authorization. For AKS Automatic, use the kubelet managed identity for required image pull access, and assign only the minimum registry role required by the registry authorization model: AcrPull for registries using RBAC only or Container Registry Repository Reader for ABAC enabled registries. Do not use --attach-acr with an ABAC enabled registry. Assign Container Registry Repository Reader manually to the kubelet managed identity and add repository conditions where required. Human users should use Microsoft Entra identities, while pipelines and workloads should use managed identities or service principals with only the required registry roles and repository conditions, rather than shared local registry credentials.