Creating a Private Azure Container Registry (ACR) using Terraform

Azure Container Registry (ACR) is a managed Docker container registry service provided by Microsoft Azure. It allows you to store, manage, and deploy Docker container images to Azure Kubernetes Service (AKS) or other container orchestration platforms. In some scenarios, you may need to create a private ACR to restrict access to your container images. In this blog post, we will walk you through the process of creating a private Azure Container Registry using Terraform.

Why Use a Private ACR?

A private Azure Container Registry offers several advantages:

1. Enhanced Security: Private ACRs allow you to control access to your container images, ensuring that only authorized users and services can pull and push images.
2. Compliance: Many compliance standards, such as HIPAA and GDPR, require strict control over data and access. A private ACR can help you meet these requirements.
3. Isolation: In multi-tenant environments, you can create private ACRs for different teams or applications, providing isolation and security.
4. Geo-replication: Azure ACR supports geo-replication, enabling you to replicate your container images to multiple Azure regions for redundancy and fast access.

Creating a Private ACR with Terraform

To create a private Azure Container Registry using Terraform, follow these steps:

1. Install Terraform : If you haven’t already, install Terraform by following the official installation guide: https://learn.hashicorp.com/tutorials/terraform/install-cli.
2. Authenticate Azure CLI : Ensure you are authenticated with your Azure subscription using the Azure CLI:
   • az login
3. Create a Terraform Configuration : Create a new directory for your Terraform configuration and create a .tf file, e.g., main.tf. Add the following content to create an Azure Container Registry:

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "acr-rg" {
  name     = "acr-rg"
  location = "East US"
}

resource "azurerm_container_registry" "example" {
  name                     = "myacr"
  resource_group_name      = azurerm_resource_group.acr-rg.name
  location                 = azurerm_resource_group.acr-rg.location
  sku                      = "Basic"
  admin_enabled            = false  # Disable admin user for added security
  georeplication_locations = ["East US 2"]  # Add more regions as needed
  public_network_access_enabled = false
}

In this Terraform configuration:

• We specify the Azure provider and create a resource group.
• We create an Azure Container Registry with the name “myacr” in the specified resource group and location. You can change these values to suit your requirements.
• We use the “Basic” SKU, but you can choose a different SKU based on your needs.
• We disable the admin user for added security. Users will need to authenticate to pull and push images.
• You can add more georeplication locations as needed for redundancy.

Initialize and Apply the Configuration

In your terminal, navigate to the directory where your Terraform configuration file is located. Initialize Terraform by running:

terraform init

Then, apply the configuration to create the private ACR:

terraform apply

Terraform will prompt you to confirm the creation of resources. Enter yes to proceed.

Once Terraform completes the deployment, you can check your private ACR on the Azure portal. Navigate to the ACR resource and manage your container images.

Conclusion

Creating a private Azure Container Registry using Terraform is a straightforward process that enhances security, compliance, and isolation for your containerized applications. By following the steps outlined in this blog post, you can quickly establish a private ACR and control access to your Docker container images in Azure.