Add Azure.ACR.ExportPolicy rule to disable container registry exports #3468

Copilot · 2025-07-08T13:42:26Z

This PR implements a new security rule Azure.ACR.ExportPolicy (AZR-000403) that ensures Azure Container Registry exports are disabled to prevent data exfiltration.

What this rule does

The rule validates that:

properties.policies.exportPolicy.status is set to "disabled"
properties.publicNetworkAccess is set to "Disabled" (required for export policy)

This prevents data movement via acr import or acr transfer commands, ensuring registry data is accessed solely through the data plane (docker pull).

Changes made

Rule implementation: Added Azure.ACR.ExportPolicy rule in Azure.ACR.Rule.ps1
Localization: Added error messages in PSRule-rules.psd1
Test coverage: Added 3 test scenarios in Azure.ACR.Tests.ps1 and Resources.ACR.json
Documentation: Created comprehensive documentation with examples for ARM templates, Bicep, CLI, and PowerShell

Test scenarios

Registry	Export Policy	Public Access	Result	Reason
registry-K	enabled	Enabled	❌ FAIL	Export policy enabled
registry-L	disabled	Enabled	❌ FAIL	Public access must be disabled
registry-M	disabled	Disabled	✅ PASS	Correctly configured

References

Fixes #3444.

Warning

Firewall rules blocked me from connecting to one or more addresses

I tried to connect to the following addresses, but was blocked by firewall rules:

www.powershellgallery.com
- Triggering command: pwsh ./build.ps1 -Build (dns block)
- Triggering command: pwsh -c Install-Module PSRule -Force -Scope CurrentUser (dns block)
- Triggering command: pwsh -c Install-Module Pester -Force -Scope CurrentUser (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to my firewall allow list

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

…xports Co-authored-by: BernieWhite <13513058+BernieWhite@users.noreply.github.com>

src/PSRule.Rules.Azure/rules/Azure.ACR.Rule.ps1

docs/en/rules/Azure.ACR.ExportPolicy.md

Co-authored-by: BernieWhite <13513058+BernieWhite@users.noreply.github.com>

src/PSRule.Rules.Azure/rules/Azure.ACR.Rule.ps1

BernieWhite · 2025-07-09T03:39:05Z

tests/PSRule.Rules.Azure.Tests/Azure.ACR.Tests.ps1

+            $ruleResult | Should -Not -BeNullOrEmpty;
+            $ruleResult.Length | Should -Be 2;
+            $ruleResult.TargetName | Should -BeIn 'registry-K', 'registry-L';
+            $ruleResult.Detail.Reason.Path | Should -BeIn 'properties.policies.exportPolicy.status', 'properties.publicNetworkAccess';


Suggested change

$ruleResult.Detail.Reason.Path | Should -BeIn 'properties.policies.exportPolicy.status', 'properties.publicNetworkAccess';

$ruleResult.Detail.Reason.Path | Should -BeIn 'properties.policies.exportPolicy.status';

Updated test assertion to only check for export policy path since public network access check was removed. Commit: f3da01b

src/PSRule.Rules.Azure/en/PSRule-rules.psd1

docs/en/rules/Azure.ACR.ExportPolicy.md

BernieWhite · 2025-07-09T03:42:59Z

docs/en/rules/Azure.ACR.ExportPolicy.md

+az acr update --name MyRegistry --public-network-enabled false
+az acr config export-policy update --registry MyRegistry --status disabled


Instead of MyRegistry use a placeholder <name>.

Replaced "MyRegistry" with "" placeholder in CLI examples. Commit: f3da01b

BernieWhite · 2025-07-09T03:43:51Z

docs/en/rules/Azure.ACR.ExportPolicy.md

+To deploy registries that pass this rule:
+
+- Set `properties.policies.exportPolicy.status` to `disabled`.
+- Set `properties.publicNetworkAccess` to `Disabled`.


Remove setting properties.publicNetworkAccess to Disabled for both Azure template and Bicep examples.

Removed publicNetworkAccess settings from both Azure template and Bicep examples. Commit: f3da01b

BernieWhite · 2025-07-09T03:47:17Z

docs/en/rules/Azure.ACR.ExportPolicy.md

+reviewed: 2025-07-09
+severity: Important
+pillar: Security
+category: DP:02 Data Protection


Suggested change

category: DP:02 Data Protection

category: SE:08 Hardening resources

Changed category from "DP:02 Data Protection" to "SE:08 Hardening resources". Commit: f3da01b

BernieWhite · 2025-07-09T03:48:17Z

docs/en/rules/Azure.ACR.ExportPolicy.md

+
+## LINKS
+
+- [Data loss prevention for Azure Container Registry](https://learn.microsoft.com/en-gb/azure/container-registry/data-loss-prevention)


Add an additional link first in the list for: [SE:08 Hardening resources](https://learn.microsoft.com/en-us/azure/well-architected/security/harden-resources) which is the reference for the WAF pillar this aligns to.

Added SE:08 Hardening resources link as the first link in the LINKS section. Commit: f3da01b

BernieWhite · 2025-07-09T03:48:40Z

docs/en/rules/Azure.ACR.ExportPolicy.md

+### Configure with Azure PowerShell
+
+```powershell
+Update-AzContainerRegistry -Name MyRegistry -ResourceGroupName MyResourceGroup -PublicNetworkAccess Disabled


Also use placeholders for name and resource group name.

Updated PowerShell example to use placeholders and corrected to use Azure CLI since PowerShell doesn't have direct export policy support. Commit: f3da01b

Co-authored-by: BernieWhite <13513058+BernieWhite@users.noreply.github.com>

BernieWhite · 2025-07-09T06:47:41Z

docs/en/rules/Azure.ACR.ExportPolicy.md

+
+## LINKS
+
+- [SE:08 Hardening resources](https://learn.microsoft.com/en-us/azure/well-architected/security/harden-resources)


Suggested change

- [SE:08 Hardening resources](https://learn.microsoft.com/en-us/azure/well-architected/security/harden-resources)

- [SE:08 Hardening resources](https://learn.microsoft.com/azure/well-architected/security/harden-resources)

Fixed URL format to remove the locale prefix. Commit: febb866

BernieWhite · 2025-07-09T06:53:36Z

docs/en/rules/Azure.ACR.ExportPolicy.md

+
+## SYNOPSIS
+
+Disable export of artifacts from Azure container registry to ensure data is accessed solely via the data plane.


In one sentence, update this synopsis to reflect what the problem is instead of what the resolution is.

Updated synopsis to describe the problem (data exfiltration risk) instead of the solution. Commit: febb866

…ution Co-authored-by: BernieWhite <13513058+BernieWhite@users.noreply.github.com>

Initial plan

69c2ce0

Copilot AI assigned Copilot and BernieWhite Jul 8, 2025

Copilot started work on behalf of BernieWhite July 8, 2025 13:42 View session

Implement Azure.ACR.ExportPolicy rule to disable container registry e…

521301e

…xports Co-authored-by: BernieWhite <13513058+BernieWhite@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] [RULE] Disable export of artifacts from an Azure container registry~~ Add Azure.ACR.ExportPolicy rule to disable container registry exports Jul 8, 2025

Copilot AI requested a review from BernieWhite July 8, 2025 13:52

Copilot finished work on behalf of BernieWhite July 8, 2025 13:52

BernieWhite requested changes Jul 9, 2025

View reviewed changes

Copilot started work on behalf of BernieWhite July 9, 2025 02:36 View session

Implement requested changes from PR review

68297e7

Co-authored-by: BernieWhite <13513058+BernieWhite@users.noreply.github.com>

Copilot AI requested a review from BernieWhite July 9, 2025 02:42

Copilot finished work on behalf of BernieWhite July 9, 2025 02:42

BernieWhite requested changes Jul 9, 2025

View reviewed changes

Copilot started work on behalf of BernieWhite July 9, 2025 03:49 View session

Address PR review feedback: remove PS rule, fix tests, update docs

f3da01b

Co-authored-by: BernieWhite <13513058+BernieWhite@users.noreply.github.com>

Copilot AI requested a review from BernieWhite July 9, 2025 03:57

Copilot finished work on behalf of BernieWhite July 9, 2025 03:57

BernieWhite requested changes Jul 9, 2025

View reviewed changes

Copilot started work on behalf of BernieWhite July 9, 2025 06:54 View session

Fix URL format and update synopsis to describe problem instead of sol…

febb866

…ution Co-authored-by: BernieWhite <13513058+BernieWhite@users.noreply.github.com>

Copilot AI requested a review from BernieWhite July 9, 2025 06:57

Copilot finished work on behalf of BernieWhite July 9, 2025 06:57

	$ruleResult.Detail.Reason.Path \| Should -BeIn 'properties.policies.exportPolicy.status', 'properties.publicNetworkAccess';
	$ruleResult.Detail.Reason.Path \| Should -BeIn 'properties.policies.exportPolicy.status';

		az acr update --name MyRegistry --public-network-enabled false
		az acr config export-policy update --registry MyRegistry --status disabled

	category: DP:02 Data Protection
	category: SE:08 Hardening resources


		## LINKS

		- [Data loss prevention for Azure Container Registry](https://learn.microsoft.com/en-gb/azure/container-registry/data-loss-prevention)


		## LINKS

		- [SE:08 Hardening resources](https://learn.microsoft.com/en-us/azure/well-architected/security/harden-resources)


		## SYNOPSIS

		Disable export of artifacts from Azure container registry to ensure data is accessed solely via the data plane.

Add Azure.ACR.ExportPolicy rule to disable container registry exports #3468

Are you sure you want to change the base?

Add Azure.ACR.ExportPolicy rule to disable container registry exports #3468

Uh oh!

Conversation

Copilot AI commented Jul 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this rule does

Changes made

Test scenarios

References

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jul 9, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI commented Jul 8, 2025 •

edited

Loading