AZ-500 Question 138
Single answerYou have created a private Azure Container Registry (ACR) named contosoregistry. A new developer, Bob, needs read-only access to pull images from this ACR. Your organization has mandated the principle of least privilege. Which method should you use to ensure Bob has just enough permissions to retrieve images?
- A
Enable admin user credentials on contosoregistry and share them directly with Bob.
- B
Create a new Azure AD user for Bob and assign him the AcrPull role scoped to contosoregistry.
- C
Assign Bob the Owner role on the resource group that contains contosoregistry.
- D
Configure a shared access signature (SAS) for contosoregistry and provide it to Bob.
Show answer and explanation
Correct answer: B
Explanation
To follow the principle of least privilege for Azure Container Registry, you should use Azure Role-Based Access Control (RBAC) with a built-in or custom role that grants only the necessary actions. In this scenario, assigning the AcrPull role to Bob at the scope of the registry gives sufficient privileges to pull images without allowing any write or administrative actions. For more details, see Microsoft’s official documentation on ACR roles at https://learn.microsoft.com/azure/container-registry/container-registry-roles.
- A. Incorrect.
Option 1 is incorrect because using the admin user credentials for the entire registry gives excessive rights to Bob and violates the principle of least privilege. Admin credentials allow actions beyond pulling images, making them insecure to share.
- B. Correct.
Option 2 is correct. Assigning the built-in AcrPull role to Bob at the registry level grants him read-only access to pull images, aligning with least privilege best practices. This leverages Azure RBAC and Azure AD identity.
- C. Incorrect.
Option 3 is incorrect. The Owner role is too broad: it grants full permissions over all resources in the resource group, which is more than read/pull access.
- D. Incorrect.
Option 4 is incorrect. SAS tokens are commonly used for storage services (e.g., Blob, File), but not typically for granting access to Azure Container Registry. ACR provides its own RBAC roles and scoped tokens.