Azure / Azure/Azure-Landing-Zones

Policy initiative defines unused and unneeded zoneId for Azure Container Registry

Open
#196 1 comment 1 reaction 0 assignees View on GitHub
Transfer From: Enterprise-Scale :arrow_right:
Dominant language
PowerShell
Stars
97
Forks
70
Avg merge
3d 1h
Merged PRs (30d)
7

Description

**Describe the bug**
The [ESLZ policy initiative](https://github.com/Azure/Enterprise-Scale/blob/main/src/resources/Microsoft.Authorization/policySetDefinitions/Deploy-Private-DNS-Zones.json) defines "azureAcrDataPrivateDnsZoneId": "{regionName}.data.privatelink.azurecr.io" in the "dnsZoneNames" parameter, but then is not used.

In fact is not needed, because the zone "{regionName}.data.privatelink.azurecr.io" is a subzone of "privatelink.azurecr.io" already addressed properly by "azureAcrPrivateDnsZoneId".

**Steps to reproduce**

1. Create ACR with private Endpoint
2. The PE contains both entries for "privatelink.azurecr.io" and "{regionName}.data.privatelink.azurecr.io", just with "azureAcrPrivateDnsZoneId", without "azureAcrDataPrivateDnsZoneId".

**Screenshots**

![Image](https://github.com/user-attachments/assets/0d0951e5-5ec4-45b2-8d2b-e8d638e89514)

Contributor guide

Open the contributing guide

Research direction

Open src/resources/Microsoft.Authorization/policySetDefinitions/Deploy-Private-DNS-Zones.json and inspect the dnsZoneNames parameter. Confirm that azureAcrDataPrivateDnsZoneId is unused while azureAcrPrivateDnsZoneId covers the relevant subzone, then remove the unused definition and verify the policy initiative remains valid.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.