Azure Container Registry Key
Description
General
- Documentation: https://learn.microsoft.com/en-us/azure/container-registry/
- Summary: Azure Container Registry allows to build, store, and manage container images and artifacts in a private registry for all types of container deployments. This detector aims to detect the credentials used to authenticate to manage the registry.
Details for Azure Container Registry Key
-
Family: credentials
-
Category: cloud_provider
-
Company: Microsoft
-
High recall: False
-
Validity check available: True
-
Analyzer available: False
-
Revoker available: True
-
On-premise instances exist: False
-
Only valid secrets raise an alert: False
-
Occurrences found for one million commits: 0.03
-
Prefixed: False
Revoker
Auth Credentials
Valid credentials needed to authenticate the request.
-
tenant_id: Directory (tenant) ID of the Microsoft Entra tenant of the service principal
-
client_id: Application (client) ID of a service principal holding the Contributor role on the container registry
-
client_secret: Client secret of the service principal
-
container_registry_resource_id: Resource ID of the container registry, as shown in the Azure portal under Properties:
/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.ContainerRegistry/registries/{registry_name}
HTTP Calls
List of calls performed by the revoker.
- GET:
/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.ContainerRegistry/registries/{registry_name}/tokens/{token_name} - POST:
/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.ContainerRegistry/registries/{registry_name}/generateCredentials - POST:
/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.ContainerRegistry/registries/{registry_name}/listCredentials - POST:
/subscriptions/{subscription_id}/resourceGroups/{resource_group}/providers/Microsoft.ContainerRegistry/registries/{registry_name}/regenerateCredential - POST:
/{tenant_id}/oauth2/v2.0/token
Revocation Mode
Revocation is asynchronous.
