Resolved

Azure Container Registry trust policy fails with Standard SKU

Azure
ACR
Terraform
DevOps
Security
Container Registry
Docker
Cost Optimization

Terraform deployment error when enabling trust policy on ACR Standard SKU | Premium SKU requirement and cost-effective alternatives for image signing

Issue

The deployment of Azure Container Registry (ACR) using Terraform failed when attempting to enable a content trust policy on a Standard SKU instance. The error occurred because Azure restricts content trust features to Premium SKU instances only, causing the deployment to block despite the need for image signing and content verification in the workflow.

Culprit

The primary cause was an architectural limitation in Azure Container Registry: content trust policies are exclusively available in Premium SKU instances, which cost $500 per month. The Terraform configuration attempted to enable a trust policy on a Standard SKU instance, which costs $20 per month and lacks this feature. This restriction is enforced at deployment time, resulting in a clear SKU mismatch error.

Solution

To resolve this issue, the following steps were taken:

  1. Disabled Trust Policy on Standard SKU: The trust_policy configuration block was removed from the Terraform file, allowing the deployment to proceed on the Standard SKU instance.

  2. Implemented Alternative Image Signing with Cosign: Instead of relying on ACR’s native content trust feature, Cosign, an open-source tool from sigstore, was adopted for image signing. Cosign provides cryptographic verification comparable to ACR’s native trust policy without requiring the Premium SKU.

  3. Kubernetes Enforcement with Gatekeeper: Admission control rules were added to enforce the use of signed images in Kubernetes deployments. This ensures that only images signed with Cosign can be deployed, maintaining security guarantees.

The changes resulted in a 96% cost reduction (from $500 to $20 per month) while maintaining security and eliminating vendor lock-in. Cosign’s integration provides robust cryptographic verification and aligns with the organization’s security policies.