azure-acr-registry-write-config
registries/write changes admin account state, trust policy, anonymous pull, network rules - alters the security posture of the entire registry.
match (effective permission)
{
"action": "Microsoft.ContainerRegistry/registries/write",
"scope_type": "resource|resourceGroup|subscription"
}
where
principal effectively holds Contributor, Owner, or a custom role including Microsoft.
ContainerRegistry/registries/write
emit
| source type | Identity |
|---|---|
| target type | * |
| source | <principal> |
| target | <registry> |
| permissions | Microsoft.ContainerRegistry/registries/write |
| state logic | ACTIVE when the principal holds effective registries/write and no deny assignment covers it. BLOCKED when a deny assignment at this scope covers Microsoft.ContainerRegistry/registries/write (denied_by=<deny assignment id>). CONDITIONAL(service_state) when registry is locked (resource lock prevents writes even if RBAC allows). |
Narrative
{principal.name} can update the configuration of registry {target.name} (registries/write) including enabling the admin account, disabling the trust policy, enabling anonymous pull, and modifying network access rules.
Raw rule rules/derived/azure/acr.yaml
id: azure-acr-registry-write-config
emits: CanModifyConfiguration
description: "registries/write changes admin account state, trust policy, anonymous pull, network rules\
\ \u2014 alters the security posture of the entire registry."
match_effective_permission:
action: Microsoft.ContainerRegistry/registries/write
scope_type: resource|resourceGroup|subscription
where:
- principal effectively holds Contributor, Owner, or a custom role including Microsoft.ContainerRegistry/registries/write
emit:
source_type: Identity
target_type: '*'
source: <principal>
target: <registry>
permissions:
- Microsoft.ContainerRegistry/registries/write
state_logic: ACTIVE when the principal holds effective registries/write and no deny assignment covers
it. BLOCKED when a deny assignment at this scope covers Microsoft.ContainerRegistry/registries/write
(denied_by=<deny assignment id>). CONDITIONAL(service_state) when registry is locked (resource lock
prevents writes even if RBAC allows).
confidence: 0.95
false_positive_note: "The high-impact configuration changes are: (a) adminUserEnabled false\u2192true\
\ (enables credential exposure \u2014 link to azure-acr-list-credentials becoming ACTIVE); (b) anonymousPullEnabled\
\ false\u2192true (enables anonymous pull \u2014 link to azure-acr-anonymous-pull-internet becoming\
\ ACTIVE); (c) trustPolicy disable (removes signature gate \u2014 mutable-tag push succeeds without\
\ signing). Model each as a CONDITIONAL upgrade of the corresponding dependent edge when the write\
\ capability is ACTIVE. A Contributor who already has push can skip the admin-enable step; the admin-account\
\ path is most useful when push is not directly available. When azure-acr-contributor emits ACTIVE\
\ CanAdminister, this CanModifyConfiguration edge is subsumed (lower traversal weight) to prevent\
\ double-counting on the same principal + registry pair. Deny assignments over write yield BLOCKED."
narrative: '{principal.name} can update the configuration of registry {target.name} (registries/write)
including enabling the admin account, disabling the trust policy, enabling anonymous pull, and modifying
network access rules.'