Evaluates as Compliant when Internet access is disabled for Container Registry instances.
Scenarios
Accessing Container Registry instances over the Internet poses network security risks. Use virtual private clouds (VPCs) instead.
Risk level
Default risk level: high.
You can change the risk level when you configure this rule.
Compliance evaluation logic
- Internet access is disabled for a Container Registry instance: Compliant.
- Internet access is enabled for a Container Registry instance: Incompliant. Follow the Incompliance remediation steps to resolve this.
Rule details
| Item | Description |
| Rule name | cr-instance-public-access-check |
| Rule identifier | cr-instance-public-access-check |
| Tag | CR and Repository |
| Automatic remediation | Not supported |
| Trigger type | Periodic execution |
| Evaluation frequency | Every 24 hours |
| Supported resource type | Container Registry instances |
| Input parameter | None |
Incompliance remediation
Disable Internet access for a Container Registry instance. For more information, see Configure internet access control.