Resolved

Azure Container Registry security downgrade removes compliance features

Azure
Security
DevOps
Terraform
rule
Container Registry
Encryption
Compliance

Critical security downgrade in Azure Container Registry (ACR) accidentally removed banking-grade compliance features, including encryption, network isolation, and content trust, violating rule Article 32 requirements.

Issue

A critical security vulnerability was introduced when Azure Container Registry (ACR) was downgraded from Premium to Basic SKU, removing essential banking-grade security features. This downgrade would have violated compliance requirements, specifically rule Article 32, by eliminating:

  1. Customer-managed encryption.
  2. Network isolation controls.
  3. Content trust for image signing.
  4. Geo-replication and zone redundancy.
  5. Retention policies required for audit compliance.

Culprit

The issue arose from Terraform configuration errors in dynamic blocks that caused syntax failures. Instead of fixing the underlying variable reference errors, the incorrect resolution involved:

  • Downgrading the ACR SKU from Premium to Basic.
  • Removing the encryption configuration tied to Azure Key Vault.
  • Eliminating network rule sets and private endpoint configurations.
  • Disabling content trust policies for image signing.
  • Deleting retention and geo-replication policies.

The root cause was a failure to properly reference Terraform variables, leading to a cascading removal of security features.

Solution

SKU Restoration

Reverted to the mandatory Premium SKU for ACR to ensure compliance with banking-grade security requirements.

Encryption Configuration

Restored customer-managed encryption by reintegrating Azure Key Vault for secure key management and ensuring encryption keys were properly referenced in the configuration.

Network Security

Reimplemented zero-trust network controls, including:

  • Default deny rules for all traffic.
  • Explicit allow rules for trusted IP ranges.
  • Virtual network integration for private endpoint access.

Compliance Features

Restored all compliance-mandated features:

  • Content Trust: Enabled for image signing to ensure integrity.
  • Retention Policies: Configured with a minimum retention period to meet compliance standards.
  • Geo-Replication: Enabled with zone redundancy for high availability.

Verification Process

Conducted thorough validation to ensure:

  • Key Vault key rotation was compatible with ACR encryption.
  • Private endpoints blocked all unauthorized public access.
  • Image signing was enforced through content trust policies.
  • Geo-replication failover scenarios were tested and functional.
  • Retention policies generated immutable audit logs.

This resolution restored full compliance with rule Article 32 while fixing the original configuration errors through proper variable references and module structure.