AZ-500 Question 137
Single answerYou have created a private Azure Container Registry (ACR) named 'contosoRegistry' for internal use. A development team needs to push newly built container images into the registry but should not delete images or manage policies. Which built-in Azure role assignment provides these capabilities while following the principle of least privilege?
- A
Assign the ACR Pull (AcrPull) role at the subscription scope
- B
Assign the ACR Push (AcrPush) role at the registry scope
- C
Assign the Contributor role at the resource group scope
- D
Assign the Reader role at the container registry scope
Show answer and explanation
Correct answer: B
Explanation
The ACR Push (AcrPush) role is designed specifically to allow pushing images to Azure Container Registry while restricting management actions like deleting images or configuring registry policies. It aligns with the least-privilege principle. For more details, refer to the official documentation on ACR built-in roles: https://docs.microsoft.com/azure/container-registry/container-registry-roles.
- A. Incorrect.
Option 1: ACR Pull (AcrPull) at the subscription scope only provides the ability to pull (read) images, not push. It also applies at a broader scope than necessary, which does not follow the principle of least privilege.
- B. Correct.
Option 2: ACR Push (AcrPush) at the registry scope is correct because it allows pushing images to the registry without granting extra permissions such as deleting images or managing the registry itself. This meets the requirement of minimal necessary rights.
- C. Incorrect.
Option 3: Contributor at the resource group scope grants more permissions than required, including the ability to modify other Azure resources within the resource group. This is not aligned with least privilege.
- D. Incorrect.
Option 4: Reader at the container registry scope can only view registry details but cannot push or modify images. This does not meet the requirement to upload images.