Container registries should use private link
Azure Private Link lets you connect your virtual network to Azure services without a public IP address at the source or destination.
Publicly reachable registries expand attack surface for credential stuffing, token abuse, and scanning. A compromise enables unauthorized pull/push, causing image data leakage and supply-chain tampering. Public routing weakens network isolation, impacting the confidentiality and integrity of images and metadata.
What this control checks
Container registries pass when they use private link and fail when they do not
Common pitfalls
Others rely on the public endpoint
Registries with private endpoint connections use private IPs; others rely on the public endpoint.
Only Approved connections count
The policy counts privateEndpointConnections whose privateLinkServiceConnectionState.status equals Approved.
Audit evidence
Evidence that deployed resources meet this control: Azure Policy compliance results for the built-in policy definition "Container registries should use private link" (e8eef0a8-67cf-4eb4-9386-14b0e78733d4); Prowler check containerregistry_uses_private_link (prowler azure --checks containerregistry_uses_private_link); PowerPipe control azure_compliance.control.container_registry_uses_private_link.
Framework-specific interpretation
NIS2 Directive (EU 2022/2555): Mapped to 11.2.2.d (ensure that access rights appropriately address third-party access, such as visitors, suppliers and service providers...).
NIST SP 800-53 Rev 5: Mapped to AC-17 (Remote Access), AC-17(1) (Monitoring and Control), AC-4 (Information Flow Enforcement) and 2 more clauses.
FedRAMP Moderate Baseline Rev 4: Mapped to AC-17 (Remote Access), AC-17(1) (Automated Monitoring/Control), AC-4 (Information Flow Enforcement) and 2 more clauses.
Framework mappings
The clauses this control is mapped to in each framework.
- 11 Access control
- AC-17 Remote Access
- AC-17(1) Monitoring And Control
- Information Flow Enforcement (AC-4)
- SC-7: Boundary Protection
- SC-7(3) Access Points
FedRAMP Moderate Baseline Rev 4
- AC-4 Information Flow Enforcement
- AC-17 (3): Managed Access Control Points
- AC-17(1) Automated Monitoring/Control
- SC-7: Boundary Protection
- SC-7(3) Access Points
- 3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- 3.1.3 Control the flow of CUI in accordance with approved authorizations
- 3.1.12: Monitor and control remote access sessions.
- 3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- 3.1.14 Route remote access via managed access control points
3 more clauses
- 3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.
- 3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- 3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- 2.2.2.1 Ensure Private Endpoints are used to access {service}
RBI Cyber Security Framework for UCBs
- Annex I (1.3)
- IAM-10.01B The cloud service provider ensures that access to its internal data and system functions is controlled and restricted to authorised personnel.
- IAM-10.02B The cloud service provider establishes processes and technical controls to manage and verify access permissions within its internal systems.
- OPS-32.01B Guidelines and instructions with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These guidelines and instructions contain specifications for the entire container life cycle...
- PSS-11.01B If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provider ensures the following aspects: - Cloud service customers can restrict the selection of images of virtual machines or containers according to their specifications, so...
- AC.L1-3.1.1 Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems)
- AC.L2-3.1.3 Control the flow of CUI in accordance with approved authorizations
- AC.L2-3.1.12 Monitor and control remote access sessions
- AC.L2-3.1.13 Employ cryptographic mechanisms to protect the confidentiality of remote access sessions
- AC.L2-3.1.14 Route remote access via managed access control points
3 more clauses
- SC.L1-3.13.1 Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems
- SC.L1-3.13.5 Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks
- SC.L2-3.13.2 Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems
- AC-4 Information Flow Enforcement
- AC-17 Remote Access
- AC-17(1) Automated Monitoring / Control
- SC-7 Boundary Protection
- SC-7(3) Access Points
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_registry_uses_private_link - Powerpipe Control:
azure_compliance.control.container_registry_uses_private_link - Prowler Check:
containerregistry_uses_private_link - Azure Policy Definition:
e8eef0a8-67cf-4eb4-9386-14b0e78733d4
Last reviewed: 2026-10-11