Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Bicep resource definition
The registries/cacheRules resource type can be deployed with operations that target:
- Resource groups - See resource group deployment commands
For a list of changed properties in each API version, see change log.
Usage Examples
Bicep Samples
A basic example of deploying Azure Container Registry Cache Rule.
param resourceName string = 'acctest0001'
param location string = 'westus'
resource registry 'Microsoft.ContainerRegistry/registries@2023-11-01-preview' = {
name: '${resourceName}registry'
location: location
sku: {
name: 'Basic'
}
properties: {
adminUserEnabled: false
anonymousPullEnabled: false
dataEndpointEnabled: false
networkRuleBypassOptions: 'AzureServices'
policies: {
exportPolicy: {
status: 'enabled'
}
quarantinePolicy: {
status: 'disabled'
}
retentionPolicy: {}
trustPolicy: {}
}
publicNetworkAccess: 'Enabled'
zoneRedundancy: 'Disabled'
}
}
resource cacheRule 'Microsoft.ContainerRegistry/registries/cacheRules@2023-07-01' = {
name: '${resourceName}-cache-rule'
parent: registry
properties: {
sourceRepository: 'mcr.microsoft.com/hello-world'
targetRepository: 'target'
}
}
Resource format
To create a Microsoft.ContainerRegistry/registries/cacheRules resource, add the following Bicep to your template.
resource symbolicname 'Microsoft.ContainerRegistry/registries/cacheRules@2026-03-01-preview' = {
parent: resourceSymbolicName
identity: {
type: 'string'
userAssignedIdentities: {
{customized property}: {}
}
}
name: 'string'
properties: {
additionalAuthenticationProperties: {
authenticationType: 'string'
// For remaining properties, see AdditionalAuthenticationProperties objects
}
credentialSetResourceId: 'string'
sourceRepository: 'string'
targetRepository: 'string'
}
}
AdditionalAuthenticationProperties objects
Set the authenticationType property to specify the type of object.
For GoogleArtifactRegistry, use:
{
authenticationType: 'GoogleArtifactRegistry'
projectNumber: 'string'
workloadIdentityPool: 'string'
workloadIdentityProvider: 'string'
}
Property Values
Microsoft.ContainerRegistry/registries/cacheRules
| Name | Description | Value |
|---|---|---|
| identity | The identity of the cache rule. | IdentityProperties |
| name | The resource name | string Constraints: Min length = 5 Max length = 50 Pattern = ^[a-zA-Z0-9-]*$ (required) |
| parent | In Bicep, you can specify the parent resource for a child resource. You only need to add this property when the child resource is declared outside of the parent resource. For more information, see Child resource outside parent resource. |
Symbolic name for resource of type: registries |
| properties | The properties of the cache rule. | CacheRuleProperties |
AdditionalAuthenticationProperties
| Name | Description | Value |
|---|---|---|
| authenticationType | Set to 'GoogleArtifactRegistry' for type GarAuthenticationProperties. | 'GoogleArtifactRegistry' (required) |
CacheRuleProperties
| Name | Description | Value |
|---|---|---|
| additionalAuthenticationProperties | Authentication configuration used by the cache rule to access the upstream source repository. | AdditionalAuthenticationProperties |
| credentialSetResourceId | The ARM resource ID of the credential store which is associated with the cache rule. | string |
| sourceRepository | Source repository pulled from upstream. | string |
| targetRepository | Target repository specified in docker pull command. Eg: docker pull myregistry.azurecr.io/{targetRepository}:{tag} |
string |
GarAuthenticationProperties
| Name | Description | Value |
|---|---|---|
| authenticationType | Authentication type discriminator. | 'GoogleArtifactRegistry' (required) |
| projectNumber | The Google Cloud Platform project that is configured for authentication Permissions should be granted to principal://iam.googleapis.com/projects/{ProjectNumber}/locations/global/workloadIdentityPools/{WorkloadIdentityPool}/providers/{WorkloadIdentityProvider}/subject/{ManagedIdentityPrincipal} |
string Constraints: Min length = 5 Max length = 30 Pattern = ^[1-9][0-9]{4,29}$ (required) |
| workloadIdentityPool | The Google Cloud platform workload identity pool used for authentication. | string Constraints: Min length = 4 Max length = 32 Pattern = ^[a-z][a-z0-9-]{2,30}[a-z0-9]$ (required) |
| workloadIdentityProvider | The Google Cloud Platform workload identity provider used for authentication. | string Constraints: Min length = 4 Max length = 32 Pattern = ^[a-z][a-z0-9-]{2,30}[a-z0-9]$ (required) |
IdentityProperties
| Name | Description | Value |
|---|---|---|
| type | The identity type. | 'None' 'SystemAssigned' 'SystemAssigned, UserAssigned' 'UserAssigned' |
| userAssignedIdentities | The list of user identities associated with the resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/ providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'. |
IdentityPropertiesUserAssignedIdentities |
IdentityPropertiesUserAssignedIdentities
| Name | Description | Value |
|---|
UserIdentityProperties
| Name | Description | Value |
|---|
ARM template resource definition
The registries/cacheRules resource type can be deployed with operations that target:
- Resource groups - See resource group deployment commands For a list of changed properties in each API version, see change log.
Usage Examples
Resource format
To create a Microsoft.ContainerRegistry/registries/cacheRules resource, add the following JSON to your template.
{
"type": "Microsoft.ContainerRegistry/registries/cacheRules",
"apiVersion": "2026-03-01-preview",
"name": "string",
"identity": {
"type": "string",
"userAssignedIdentities": {
"{customized property}": {
}
}
},
"properties": {
"additionalAuthenticationProperties": {
"authenticationType": "string"
// For remaining properties, see AdditionalAuthenticationProperties objects
},
"credentialSetResourceId": "string",
"sourceRepository": "string",
"targetRepository": "string"
}
}
AdditionalAuthenticationProperties objects
Set the authenticationType property to specify the type of object.
For GoogleArtifactRegistry, use:
{
"authenticationType": "GoogleArtifactRegistry",
"projectNumber": "string",
"workloadIdentityPool": "string",
"workloadIdentityProvider": "string"
}
Property Values
Microsoft.ContainerRegistry/registries/cacheRules
| Name | Description | Value |
|---|---|---|
| apiVersion | The api version | '2026-03-01-preview' |
| identity | The identity of the cache rule. | IdentityProperties |
| name | The resource name | string Constraints: Min length = 5 Max length = 50 Pattern = ^[a-zA-Z0-9-]*$ (required) |
| properties | The properties of the cache rule. | CacheRuleProperties |
| type | The resource type | 'Microsoft.ContainerRegistry/registries/cacheRules' |
AdditionalAuthenticationProperties
| Name | Description | Value |
|---|---|---|
| authenticationType | Set to 'GoogleArtifactRegistry' for type GarAuthenticationProperties. | 'GoogleArtifactRegistry' (required) |
CacheRuleProperties
| Name | Description | Value |
|---|---|---|
| additionalAuthenticationProperties | Authentication configuration used by the cache rule to access the upstream source repository. | AdditionalAuthenticationProperties |
| credentialSetResourceId | The ARM resource ID of the credential store which is associated with the cache rule. | string |
| sourceRepository | Source repository pulled from upstream. | string |
| targetRepository | Target repository specified in docker pull command. Eg: docker pull myregistry.azurecr.io/{targetRepository}:{tag} |
string |
GarAuthenticationProperties
| Name | Description | Value |
|---|---|---|
| authenticationType | Authentication type discriminator. | 'GoogleArtifactRegistry' (required) |
| projectNumber | The Google Cloud Platform project that is configured for authentication Permissions should be granted to principal://iam.googleapis.com/projects/{ProjectNumber}/locations/global/workloadIdentityPools/{WorkloadIdentityPool}/providers/{WorkloadIdentityProvider}/subject/{ManagedIdentityPrincipal} |
string Constraints: Min length = 5 Max length = 30 Pattern = ^[1-9][0-9]{4,29}$ (required) |
| workloadIdentityPool | The Google Cloud platform workload identity pool used for authentication. | string Constraints: Min length = 4 Max length = 32 Pattern = ^[a-z][a-z0-9-]{2,30}[a-z0-9]$ (required) |
| workloadIdentityProvider | The Google Cloud Platform workload identity provider used for authentication. | string Constraints: Min length = 4 Max length = 32 Pattern = ^[a-z][a-z0-9-]{2,30}[a-z0-9]$ (required) |
IdentityProperties
| Name | Description | Value |
|---|---|---|
| type | The identity type. | 'None' 'SystemAssigned' 'SystemAssigned, UserAssigned' 'UserAssigned' |
| userAssignedIdentities | The list of user identities associated with the resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/ providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'. |
IdentityPropertiesUserAssignedIdentities |
IdentityPropertiesUserAssignedIdentities
| Name | Description | Value |
|---|
UserIdentityProperties
| Name | Description | Value |
|---|
Terraform (AzAPI provider) resource definition
The registries/cacheRules resource type can be deployed with operations that target:
- Resource groups For a list of changed properties in each API version, see change log.
Usage Examples
Terraform Samples
A basic example of deploying Azure Container Registry Cache Rule.
terraform {
required_providers {
azapi = {
source = "Azure/azapi"
}
}
}
provider "azapi" {
skip_provider_registration = false
}
variable "resource_name" {
type = string
default = "acctest0001"
}
variable "location" {
type = string
default = "westus"
}
resource "azapi_resource" "resourceGroup" {
type = "Microsoft.Resources/resourceGroups@2020-06-01"
name = var.resource_name
location = var.location
}
resource "azapi_resource" "registry" {
type = "Microsoft.ContainerRegistry/registries@2023-11-01-preview"
parent_id = azapi_resource.resourceGroup.id
name = "${var.resource_name}registry"
location = var.location
body = {
properties = {
adminUserEnabled = false
anonymousPullEnabled = false
dataEndpointEnabled = false
networkRuleBypassOptions = "AzureServices"
policies = {
exportPolicy = {
status = "enabled"
}
quarantinePolicy = {
status = "disabled"
}
retentionPolicy = {}
trustPolicy = {}
}
publicNetworkAccess = "Enabled"
zoneRedundancy = "Disabled"
}
sku = {
name = "Basic"
}
}
}
resource "azapi_resource" "cacheRule" {
type = "Microsoft.ContainerRegistry/registries/cacheRules@2023-07-01"
parent_id = azapi_resource.registry.id
name = "${var.resource_name}-cache-rule"
body = {
properties = {
sourceRepository = "mcr.microsoft.com/hello-world"
targetRepository = "target"
}
}
}
Resource format
To create a Microsoft.ContainerRegistry/registries/cacheRules resource, add the following Terraform to your template.
resource "azapi_resource" "symbolicname" {
type = "Microsoft.ContainerRegistry/registries/cacheRules@2026-03-01-preview"
name = "string"
parent_id = "string"
identity {
type = "string"
identity_ids = [
"string"
]
}
body = {
properties = {
additionalAuthenticationProperties = {
authenticationType = "string"
// For remaining properties, see AdditionalAuthenticationProperties objects
}
credentialSetResourceId = "string"
sourceRepository = "string"
targetRepository = "string"
}
}
}
AdditionalAuthenticationProperties objects
Set the authenticationType property to specify the type of object.
For GoogleArtifactRegistry, use:
{
authenticationType = "GoogleArtifactRegistry"
projectNumber = "string"
workloadIdentityPool = "string"
workloadIdentityProvider = "string"
}
Property Values
Microsoft.ContainerRegistry/registries/cacheRules
| Name | Description | Value |
|---|---|---|
| identity | The identity of the cache rule. | IdentityProperties |
| name | The resource name | string Constraints: Min length = 5 Max length = 50 Pattern = ^[a-zA-Z0-9-]*$ (required) |
| parent_id | The ID of the resource that is the parent for this resource. | ID for resource of type: registries |
| properties | The properties of the cache rule. | CacheRuleProperties |
| type | The resource type | "Microsoft.ContainerRegistry/registries/cacheRules@2026-03-01-preview" |
AdditionalAuthenticationProperties
| Name | Description | Value |
|---|---|---|
| authenticationType | Set to 'GoogleArtifactRegistry' for type GarAuthenticationProperties. | 'GoogleArtifactRegistry' (required) |
CacheRuleProperties
| Name | Description | Value |
|---|---|---|
| additionalAuthenticationProperties | Authentication configuration used by the cache rule to access the upstream source repository. | AdditionalAuthenticationProperties |
| credentialSetResourceId | The ARM resource ID of the credential store which is associated with the cache rule. | string |
| sourceRepository | Source repository pulled from upstream. | string |
| targetRepository | Target repository specified in docker pull command. Eg: docker pull myregistry.azurecr.io/{targetRepository}:{tag} |
string |
GarAuthenticationProperties
| Name | Description | Value |
|---|---|---|
| authenticationType | Authentication type discriminator. | 'GoogleArtifactRegistry' (required) |
| projectNumber | The Google Cloud Platform project that is configured for authentication Permissions should be granted to principal://iam.googleapis.com/projects/{ProjectNumber}/locations/global/workloadIdentityPools/{WorkloadIdentityPool}/providers/{WorkloadIdentityProvider}/subject/{ManagedIdentityPrincipal} |
string Constraints: Min length = 5 Max length = 30 Pattern = ^[1-9][0-9]{4,29}$ (required) |
| workloadIdentityPool | The Google Cloud platform workload identity pool used for authentication. | string Constraints: Min length = 4 Max length = 32 Pattern = ^[a-z][a-z0-9-]{2,30}[a-z0-9]$ (required) |
| workloadIdentityProvider | The Google Cloud Platform workload identity provider used for authentication. | string Constraints: Min length = 4 Max length = 32 Pattern = ^[a-z][a-z0-9-]{2,30}[a-z0-9]$ (required) |
IdentityProperties
| Name | Description | Value |
|---|---|---|
| type | The identity type. | 'None' 'SystemAssigned' 'SystemAssigned, UserAssigned' 'UserAssigned' |
| userAssignedIdentities | The list of user identities associated with the resource. The user identity dictionary key references will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/ providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'. |
IdentityPropertiesUserAssignedIdentities |
IdentityPropertiesUserAssignedIdentities
| Name | Description | Value |
|---|
UserIdentityProperties
| Name | Description | Value |
|---|