Azure / Azure/Azure-Landing-Zones
Policy initiative defines unused and unneeded zoneId for Azure Container Registry
- Dominant language
- PowerShell
- Stars
- 97
- Forks
- 70
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 7
Description
**Describe the bug**
The [ESLZ policy initiative](https://github.com/Azure/Enterprise-Scale/blob/main/src/resources/Microsoft.Authorization/policySetDefinitions/Deploy-Private-DNS-Zones.json) defines "azureAcrDataPrivateDnsZoneId": "{regionName}.data.privatelink.azurecr.io" in the "dnsZoneNames" parameter, but then is not used.
In fact is not needed, because the zone "{regionName}.data.privatelink.azurecr.io" is a subzone of "privatelink.azurecr.io" already addressed properly by "azureAcrPrivateDnsZoneId".
**Steps to reproduce**
1. Create ACR with private Endpoint
2. The PE contains both entries for "privatelink.azurecr.io" and "{regionName}.data.privatelink.azurecr.io", just with "azureAcrPrivateDnsZoneId", without "azureAcrDataPrivateDnsZoneId".
**Screenshots**

Contributor guide
Research direction
Open src/resources/Microsoft.Authorization/policySetDefinitions/Deploy-Private-DNS-Zones.json and inspect the dnsZoneNames parameter. Confirm that azureAcrDataPrivateDnsZoneId is unused while azureAcrPrivateDnsZoneId covers the relevant subzone, then remove the unused definition and verify the policy initiative remains valid.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100