cr-instance-any-ip-access-check
Updated at:
Evaluates as Compliant if no Container Registry instance has 0.0.0.0/0 in its IP whitelist.
Scenarios
Adding 0.0.0.0/0 to a Container Registry instance's IP whitelist opens access from all CIDR blocks, which poses high security risks. Proceed with caution.
Risk level
Default risk level: high.
You can change the risk level when you configure this rule.
Evaluation logic
- If 0.0.0.0/0 is not added to the IP whitelist of each Container Registry instance, the evaluation result is Compliant.
- If 0.0.0.0/0 is in the IP whitelist of a Container Registry instance, the result is Incompliant. Follow the Incompliance remediation steps to fix this.
Rule details
| Item | Description |
| Rule name | cr-instance-any-ip-access-check |
| Rule identifier | cr-instance-any-ip-access-check |
| Tag | CR and Repository |
| Automatic remediation | Not supported |
| Trigger type | Periodic execution |
| Evaluation frequency | Every 24 hours |
| Supported resource type | Container Registry instances |
| Input parameter | None |
Incompliance remediation
Remove 0.0.0.0/0 from the IP whitelist of a Container Registry instance. For more information, see Configure a repository to be immutable.
Is this page helpful?