Governance Policies Azure Compute Container Instances

Container Instances

Governance policies for Container Instances

Domain: azure-compute

Patterns

Name	Description
ACI with VNet injection and managed identity	Private container group with VNet integration, managed identity for ACR pull, and encrypted secrets

Anti-Patterns

Description	Instead
Do not deploy containers with public IP addresses	Use VNet injection with ipAddress.type=Private and subnetIds
Do not use registry passwords for image pull	Use managed identity with AcrPull role assignment on the container registry

References

• Azure Container Instances documentation
• ACI VNet deployment

---

Checks (4)

Check	Severity	Description
AZ-ACI-001	Required	Deploy Azure Container Instances with managed identity, VNet injection, and no public IP
AZ-ACI-002	Required	Use secure environment variables or Key Vault references for secrets
AZ-ACI-003	Recommended	Set resource limits and requests on all containers
AZ-ACI-004	Recommended	Pull images from a private registry using managed identity

---

AZ-ACI-001

Deploy Azure Container Instances with managed identity, VNet injection, and no public IP

Severity: Required
Rationale: ACI containers often run batch or integration tasks; VNet injection prevents public exposure, managed identity removes credential needs
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

• Microsoft.ContainerInstance/containerGroups

Companion Resources

Resource	Name	Purpose
Microsoft.ContainerRegistry/registries	Container Registry	Private container registry for image storage — use managed identity for image pull
Microsoft.Insights/diagnosticSettings	diag-aci	Diagnostic settings to route container logs and events to Log Analytics
Microsoft.Authorization/roleAssignments	AcrPull role	RBAC role assignment granting ACI managed identity the AcrPull role on the container registry

---

AZ-ACI-002

Use secure environment variables or Key Vault references for secrets

Severity: Required
Rationale: Plain-text environment variables are visible in container group definitions; secure variables are encrypted at rest
Agents: terraform-agent, bicep-agent, cloud-architect, app-developer, csharp-developer, python-developer

Targets

• Microsoft.ContainerInstance/containerGroups

---

AZ-ACI-003

Set resource limits and requests on all containers

Severity: Recommended
Rationale: Resource limits prevent noisy-neighbor issues and ensure predictable performance
Agents: terraform-agent, bicep-agent, cloud-architect

Targets

• Microsoft.ContainerInstance/containerGroups

---

AZ-ACI-004

Pull images from a private registry using managed identity

Severity: Recommended
Rationale: Public registry pulls are subject to rate limiting, supply chain attacks, and unavailability
Agents: terraform-agent, bicep-agent, cloud-architect, app-developer, csharp-developer, python-developer

Targets

• Microsoft.ContainerInstance/containerGroups

---