Enforcing image signing and scanning in Azure Container Registry

Question

Pulumi · Accepted Answer

Enforcing image signing and scanning in Azure Container Registry is a security best practice that helps ensure that only trusted container images are deployed. This can be achieved by integrating several Azure services and features, including the Azure Container Registry's content trust and image scanning policies.

In this guide, we're going to create an Azure Container Registry with enforced image signing and scanning using Pulumi and TypeScript. We'll be using the `azure-native` provider, which interacts with Azure resources using the native Azure SDK.

Here's a breakdown of what we will do:

1. **Set up an Azure Container Registry (ACR):** This service will store our container images.
2. **Configure Trust Policy:** The registry will be configured with a trust policy, ensuring that only signed images can be pulled.
3. **Enable Content Trust:** This prevents unsigned images from being deployed.
4. **Set up Scanning:** We’ll ensure that our images are scanned for vulnerabilities upon push events.

Now, let's write the Pulumi TypeScript program to enforce these features.

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as azure_native from "@pulumi/azure-native";

// Create an Azure Resource Group
const resourceGroup = new azure_native.resources.ResourceGroup("myResourceGroup");

// Create an Azure Container Registry with content trust policy and scanning enabled
const registry = new azure_native.containerregistry.Registry("myRegistry", {
    resourceGroupName: resourceGroup.name,
    location: resourceGroup.location,
    sku: {
        name: "Premium", // Premium SKU is required for content trust and image scanning features
    },
    policies: {
        trustPolicy: {
            type: "Notary", // This enables the content trust feature
            status: "enabled", // Enabling the trust policy to enforce image signing
        },
        quarantinePolicy: {
            status: "enabled", // Enabling image scanning on push
        },
    },
});

export const registryName = registry.name;
export const registryLoginServer = registry.loginServer;

```

Here's what each part of the code does:

- We import the required Pulumi modules and set up an Azure Resource Group to host our resources.
- We then create an Azure Container Registry with a `Premium` SKU, as this is necessary for both content trust and image scanning capabilities.
- Inside the `policies` object of the registry, we enable:
  - **Trust Policy:** This is represented by the `trustPolicy` which is set to `Notary` and `status` set to `enabled`. This means that image integrity is enforced and only signed images can be pulled from the registry.
  - **Quarantine Policy:** By setting `quarantinePolicy` `status` to `enabled`, any pushed image to the registry is scanned for vulnerabilities before it's distributed.

We also export two outputs: the registry name and the login server endpoint. These can be used to integrate with CI/CD pipelines for image push, pull, and signing operations.

To run this program:
1. Install Pulumi CLI and set up Azure.
2. Run `pulumi new typescript` in your CLI to create a new Pulumi TypeScript project.
3. Replace the contents of `index.ts` with the code above.
4. Run `pulumi up` to deploy the resources.

After deployment, your Azure Container Registry will only accept signed images and will automatically scan pushed images for vulnerabilities. This greatly enhances the security of your container deployment pipeline.