Container Instance container groups should use secure environment variables
Ensure that container instance container group uses secured environment variables. This control is non-compliant if container instance container group does not uses secured environment variables. The powerpipe check queries azure_container_group.
What this control checks
Container group has no environment variable with a plain value; otherwise it is in alarm.
Common pitfalls
Any environment variable with a value is unsecured
A container group goes to alarm when any environment variable has a value that is not null.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.container_instance_container_group_secured_environment_variable.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_instance_container_group_secured_environment_variable - Powerpipe Control:
azure_compliance.control.container_instance_container_group_secured_environment_variable
Last reviewed: 2026-10-11