Container Instance container groups should be in a virtual network
This control ensures that the container group is deployed into a virtual network. Azure Policy describes it as secure communication between your containers with Azure Virtual Networks. Checkov looks at `subnet_ids` on `azurerm_container_group`.
When you specify a virtual network, resources within the virtual network can securely and privately communicate with each other. Ensuring container instances use private vNets reduces public exposure and limits potential security risks.
What this control checks
Container Instance container groups must be placed in a virtual network
Common pitfalls
KICS flags Public and None ip_address_type
KICS flags azurerm_container_group resources with ip_address_type set to Public. KICS also flags azurerm_container_group resources with ip_address_type set to None.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Azure Container Instance container group should deploy into a virtual network" (8af8f826-edcb-4178-b35f-851ea6fea615); PowerPipe control azure_compliance.control.container_instance_container_group_in_virtual_network.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_98; KICS query "Beta - Container Instances Not Using Private Virtual Networks" (71884fcb-ae03-41c8-87b9-22c90353f256).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_instance_container_group_in_virtual_network - Checkov Check:
CKV_AZURE_98 - Powerpipe Control:
azure_compliance.control.container_instance_container_group_in_virtual_network - Azure Policy Definition:
8af8f826-edcb-4178-b35f-851ea6fea615 - KICS Query:
71884fcb-ae03-41c8-87b9-22c90353f256
Last reviewed: 2026-10-11