# Cis Aks V170 5.1.4

> Minimize Container Registries to only those approved (Manual)

- Skill: `cyberstrikeus/cis-aks-v170-5-1-4` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-aks-v170-5-1-4`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-aks-v170-5-1-4/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-aks-v170-5-1-4

---


# 5.1.4 Minimize Container Registries to only those approved (Manual)

## Profile Applicability

- Level 2

## Description

Use approved container registries.

## Rationale

Allowing unrestricted access to external container registries provides the opportunity for malicious or unapproved containers to be deployed into the cluster. Allowlisting only approved container registries reduces this risk.

## Impact

All container images to be deployed to the cluster must be hosted within an approved container image registry.

## Audit

Review the list of container registries accessible from the AKS cluster and ensure only approved registries are allowed.

## Remediation

If you are using Azure Container Registry you have this option:
https://docs.microsoft.com/en-us/azure/container-registry/container-registry-firewall-access-rules

For other non-AKS repos using admission controllers or Azure Policy will also work.

Limiting or locking down egress traffic is also recommended:
https://docs.microsoft.com/en-us/azure/aks/limit-egress-traffic

## References

1. https://docs.microsoft.com/security/benchmark/azure/security-controls-v2-asset-management#am-6-use-only-approved-applications-in-compute-resources
2. https://docs.microsoft.com/en-us/azure/aks/limit-egress-traffic
3. https://docs.microsoft.com/en-us/azure/container-registry/container-registry-firewall-access-rules

## CIS Controls

| Controls Version | Control                           | IG 1 | IG 2 | IG 3 |
| ---------------- | --------------------------------- | ---- | ---- | ---- |
| v8               | 2.5 Allowlist Authorized Software |      | x    | x    |
| v7               | 5.2 Maintain Secure Images        |      | x    | x    |
| v7               | 5.3 Securely Store Master Images  |      | x    | x    |