Azure Compliance ControlsAzure Container Registry
Container registries should have the retention policy enabled
Ensure container registry retention policy is enabled. This control is non-compliant if retention policy is disabled. Checkov CKV_AZURE_167 checks that a retention policy is set to cleanup untagged manifests.
What this control checks
Container registry retention policy must be enabled; disabled retention policy is non-compliant.
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_registry_retention_policy_enabled - Checkov Check:
CKV_AZURE_167 - Powerpipe Control:
azure_compliance.control.container_registry_retention_policy_enabled
Last reviewed: 2026-10-11