Anonymous pull access should not be enabled

[BernieWhite]

Existing rule

No response

Suggested rule

Create rule Azure.ACR.AnonymousAccess that checks if anonymous access is enabled.

If anonymous is enabled, the rule should fail.

By default, anonymous is not enabled but may be explicitly set to enabled by setting properties.anonymousPullEnabled to true.

Anonymous access can currently only be enabled on Standard and Premium tiers, and is a preview feature.

Pillar

Security

Additional context

• https://learn.microsoft.com/en-us/azure/well-architected/security/design-identity-authentication
• https://learn.microsoft.com/en-gb/azure/container-registry/anonymous-pull-access
• https://learn.microsoft.com/en-us/azure/templates/microsoft.containerregistry/registries?pivots=deployment-language-bicep

[BenjaminEngeset]

I can contribute on this one.

[BernieWhite]

Thanks @BenjaminEngeset