Azure attribute-based access control (Azure ABAC) repository permissions in Azure Container Registry

When creating a new registry through Azure portal, select RBAC Registry + ABAC Repository Permissions for Role assignment permissions mode.

When running az acr create, use the --role-assignment-mode parameter to set the role assignment permissions mode. Specify rbac-abac to create a registry with Azure ABAC enabled:

az acr create --name <registry-name> --resource-group <resource-group> --sku <sku> --role-assignment-mode 'rbac-abac' --location <location>

To view the existing role assignment permissions mode of a registry, go to the registry in the Azure portal. In the service menu, under Settings, select Properties, then check the Role assignment permissions mode setting.

To enable Azure RBAC, select RBAC Registry + ABAC Repository Permissions, then select Save.

When running az acr update, use the --role-assignment-mode parameter to set the registry role assignment permissions mode. Specify rbac-abac to create a registry with RBAC Registry + ABAC Repository Permissions enabled.

To show the current role assignment permissions mode of a registry, run the following command:

az acr show --name <registry-name> --resource-group <resource-group> --query "roleAssignmentMode"

To update an existing registry to enable Azure ABAC, run the following command:

az acr update --name <registry-name> --resource-group <resource-group> --role-assignment-mode 'rbac-abac'

1. Go to the registry in the Azure portal. In the service menu, select Access control (IAM).

2. Select Add, and then select Add role assignment.

3. Search for Container Registry Repository Reader. Select that role, and then select Next.

4. In the Members tab, specify the identity who should be assigned this role, and then select Next.

5. In the Conditions tab, select Add condition.

6. Ensure Visual is selected for Editor type.

7. Under Condition #1, select the actions (permissions) belonging to this role that you want to grant in this repository-scoped role assignment. In most cases, select all actions to limit all actions performed by identities with this role to the repository scope. Choose Select to save your changes.

   

8. Next, under Build expression, select Add expression. Configure the following options for the expression to scope the ABAC condition to a specific repository:

   • Attribute source: Request
   • Attribute: Repository name
   • Operator: StringEqualsIgnoreCase
   • Value: <repository-name> - the full name of the repository

   

9. Select Save to save the ABAC condition, and then review the code expression of the ABAC condition. You can use this code to perform the same role assignment with the same ABAC condition by using the Azure CLI.

   

10. Select Review + assign to finalize the role assignment.

After you create the role assignment, you can view, edit, or delete it in the Access control (IAM) page for your registry by selecting Role assignments.

To add a role assignment with an ABAC condition scoped to a specific repository, use az role assignment create. This command includes the following parameters related to ABAC conditions:

To create the expression for the ABAC condition, we recommend using the visual editor in the Azure portal role assignment experience. For this example, use the following expression for the ABAC condition to restrict the role assignment to the repository hello-world:

(
 (
  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/content/read'})
  AND
  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/metadata/read'})
 )
 OR 
 (
  @Request[Microsoft.ContainerRegistry/registries/repositories:name] StringEqualsIgnoreCase 'hello-world'
 )
)

You can store this ABAC condition into a shell variable named condition for use in the az role assignment create command:

condition=$(cat <<'EOF' | tr -d '\n'
(
 (
  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/content/read'})
  AND
  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/metadata/read'})
 )
 OR 
 (
  @Request[Microsoft.ContainerRegistry/registries/repositories:name] StringEqualsIgnoreCase 'hello-world'
 )
)
EOF
)

Inspect the condition variable carefully to verify that it's correct. Be sure to use double quotes (") whenever you use the condition variable.

echo "$condition"

Before performing the role assignment, query the registry resource ID for the --scope parameter. Always use the registry resource ID (without the repository name) for the --scope parameter, even for role assignments scoped to a specific repository. You can also specify the resource group or subscription scope to perform this role assignment across all registries in the resource group or subscription.

scope=$(az acr show --name <registry-name> --resource-group <resource-group> --query "id" -o tsv)

Finally, run the following command to perform the role assignment:

az role assignment create \
  --role "Container Registry Repository Reader" \
  --scope "$scope" \
  --assignee "user@contoso.com" \
  --description "Read access to a specific repository" \
  --condition "$condition" \
  --condition-version "2.0"

The following shows an example of the output:

{
    "canDelegate": null,
    "condition": "( (  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/content/read'})  AND  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/metadata/read'}) ) OR  (  @Request[Microsoft.ContainerRegistry/registries/repositories:name] StringEqualsIgnoreCase 'hello-world' ))",
    "conditionVersion": "2.0",
    "description": "{description}",
    "id": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId}",
    "name": "{roleAssignmentId}",
    "principalId": "{userObjectId}",
    "principalType": "User",
    "resourceGroup": "{resourceGroup}",
    "roleDefinitionId": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}",
    "scope": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.ContainerRegistry/registries/{registryName}",
    "type": "Microsoft.Authorization/roleAssignments"
}

To update or delete the role assignment, use az role assignment update or az role assignment delete.

If you followed the previous example to assign the Container Registry Repository Reader role to a specific repository, delete that role assignment before you create a new one. You can delete the assignment in Access control (IAM) by selecting Role assignments, selecting the role assignment, and then selecting Delete.

1. Follow the same steps as in the previous example to perform a role assignment with ABAC conditions.

2. In the step to add an expression for the ABAC condition, configure an expression for an ABAC condition to scope the role assignment to multiple repositories with a common prefix (wildcard). Configure the following options:

   • Attribute source: Request

   • Attribute: Repository name

   • Operator: StringStartsWithIgnoreCase

   • Value: <repository-prefix> - the prefix of the repositories, including the trailing slash /. For example, to grant permissions to all repositories with the prefix backend/, such as backend/nginx and backend/redis, enter backend/. To grant permissions to all repositories with the prefix frontend/js/, such as frontend/js/react and frontend/js/vue, enter frontend/js/.

     Important

     The trailing slash / is required in the Value field for the expression of the ABAC condition. If you don't include the trailing slash /, you might unintentionally grant permissions to other repositories that don't match the prefix. For example, if you enter backend without the trailing slash /, the role assignment grants permissions to all repositories with the prefix backend, such as backend/nginx, backend/redis, backend-infra/k8s, backend-backup/store, backend, and backendsvc/containers.

3. Select Save to save the ABAC condition, then review the code expression of the ABAC condition.

4. Select Review + assign to finalize the role assignment.

If you followed the previous example to assign the Container Registry Repository Reader role to a specific repository, delete that role assignment (by using az role assignment delete) before creating a new one with an ABAC condition scoped to a repository prefix.

To add a role assignment with an ABAC condition scoped to multiple repositories under a prefix, use az role assignment create.

To create the expression for the ABAC condition, we recommend using the visual editor in the Azure portal role assignment experience. For this example, use the following expression for the ABAC condition to restrict the role assignment to repositories with the prefix backend/, such as backend/nginx and backend/redis:

(
 (
  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/content/read'})
  AND
  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/metadata/read'})
 )
 OR 
 (
  @Request[Microsoft.ContainerRegistry/registries/repositories:name] StringStartsWithIgnoreCase 'backend/'
 )
)

Follow the steps described in the first section to store this ABAC condition into a shell variable named condition and query the registry resource ID for the --scope parameter. Then perform the role assignment by running the following command:

az role assignment create \
  --role "Container Registry Repository Reader" \
  --scope "$scope" \
  --assignee "user@contoso.com" \
  --description "Read access to a multiple repositories under a repository prefix" \
  --condition "$condition" \
  --condition-version "2.0"

The following shows an example of the output:

{
    "canDelegate": null,
    "condition": "( (  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/content/read'})  AND  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/metadata/read'}) ) OR  (  @Request[Microsoft.ContainerRegistry/registries/repositories:name] StringStartsWithIgnoreCase 'backend/' ))",
    "conditionVersion": "2.0",
    "description": "{description}",
    "id": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId}",
    "name": "{roleAssignmentId}",
    "principalId": "{userObjectId}",
    "principalType": "User",
    "resourceGroup": "{resourceGroup}",
    "roleDefinitionId": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}",
    "scope": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.ContainerRegistry/registries/{registryName}",
    "type": "Microsoft.Authorization/roleAssignments"
}

If you followed the previous example to assign the Container Registry Repository Reader role to a specific repository prefix, delete that role assignment before you create a new one. You can delete the assignment in Access control (IAM) by selecting Role assignments, selecting the role assignment, and then selecting Delete.

1. Follow the same steps as in the first example to perform a role assignment with ABAC conditions.

2. In the step to add an expression for the ABAC condition, configure two expressions to scope the role assignment to multiple repositories under two prefixes: backend/ and frontend/js/ (multiple wildcards). Include the trailing slash / in each prefix.

   For the first expression, configure the following options:

   • Attribute source: Request
   • Attribute: Repository name
   • Operator: StringStartsWithIgnoreCase
   • Value: backend/

3. Select Add expression. The visual editor also supports multiple boolean operators including And, Or, hierarchical grouping, and negation. For this example, ensure that the boolean operator is set to Or.

4. For the second expression, configure the following options:

   • Attribute source: Request
   • Attribute: Repository name
   • Operator: StringStartsWithIgnoreCase
   • Value: frontend/js/

   

5. Select Save to save the ABAC condition, then review the code expression of the ABAC condition.

6. Select Review + assign to finalize the role assignment.

If you followed the previous example to assign the Container Registry Repository Reader role to a specific repository prefix, delete that role assignment (by using az role assignment delete) before creating a new one with an ABAC condition scoped to a repository prefix.

To add a role assignment with an ABAC condition scoped to multiple repositories under a prefix, use az role assignment create.

To create the expression for the ABAC condition, we recommend using the visual editor in the Azure portal role assignment experience. For this example, use the following expression for the ABAC condition to restrict the role assignment to repositories with either the prefix backend/ or frontend/js/:

(
 (
  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/content/read'})
  AND
  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/metadata/read'})
 )
 OR 
 (
  @Request[Microsoft.ContainerRegistry/registries/repositories:name] StringStartsWithIgnoreCase 'backend/'
  OR
  @Request[Microsoft.ContainerRegistry/registries/repositories:name] StringStartsWithIgnoreCase 'frontend/js/'
 )
)

Follow the steps described in the first section to store this ABAC condition into a shell variable named condition and query the registry resource ID for the --scope parameter. Then perform the role assignment by running the following command:

az role assignment create \
  --role "Container Registry Repository Reader" \
  --scope "$scope" \
  --assignee "user@contoso.com" \
  --description "Read access to a multiple repositories under multiple repository prefixes" \
  --condition "$condition" \
  --condition-version "2.0"

The following shows an example of the output:

{
    "canDelegate": null,
    "condition": "( (  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/content/read'})  AND  !(ActionMatches{'Microsoft.ContainerRegistry/registries/repositories/metadata/read'}) ) OR  (  @Request[Microsoft.ContainerRegistry/registries/repositories:name] StringStartsWithIgnoreCase 'backend/' ))",
    "conditionVersion": "2.0",
    "description": "{description}",
    "id": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Authorization/roleAssignments/{roleAssignmentId}",
    "name": "{roleAssignmentId}",
    "principalId": "{userObjectId}",
    "principalType": "User",
    "resourceGroup": "{resourceGroup}",
    "roleDefinitionId": "/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/{roleDefinitionId}",
    "scope": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.ContainerRegistry/registries/{registryName}",
    "type": "Microsoft.Authorization/roleAssignments"
}

In the Azure portal, go to the registry. In the service menu, under Settings, select Properties. Change the Role assignment permissions mode to RBAC Registry + ABAC Repository Permissions, and then select Save.

az acr update --name <registry-name> --resource-group <resource-group> --role-assignment-mode 'rbac-abac'