Azure Compliance ControlsAzure Container Instances
Container Instance container groups should be in a virtual network
This control ensures that the container group is deployed into a virtual network. Azure Policy describes it as secure communication between your containers with Azure Virtual Networks. Checkov looks at `subnet_ids` on `azurerm_container_group`.
What this control checks
Container Instance container groups must be placed in a virtual network
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_instance_container_group_in_virtual_network - Checkov Check:
CKV_AZURE_98 - Powerpipe Control:
azure_compliance.control.container_instance_container_group_in_virtual_network - Azure Policy Definition:
8af8f826-edcb-4178-b35f-851ea6fea615 - KICS Query:
71884fcb-ae03-41c8-87b9-22c90353f256
Last reviewed: 2026-10-11