Question

Your team runs a nightly batch job as an Azure Container Instance (ACI) container group. The image is stored in a Premium Azure Container Registry named 'contosoacr'. Security policy prohibits storing registry admin credentials or long-lived passwords anywhere in the deployment pipeline. You must configure the container group to pull the image from the registry without embedding any static secrets. What should you do?

Accepted Answer

Assign a user-assigned managed identity to the container group and grant it the AcrPull role on the registry, then reference the identity when creating the container instance.

Answer

Enable the ACR admin user and pass the admin username and password as secure environment variables in the ACI deployment.

Answer

Create a service principal, store its password in the deployment template, and use it as the registry credential for the container group.

Answer

Generate a repository-scoped access token in the registry and hardcode the token password into the ACI YAML file.