Container registries should have geo-replication enabled
Ensure that container registries are geo-replicated to align with multi-region container deployments. Checkov CKV_AZURE_165 looks at `azurerm_container_registry` for the `Premium` `sku` with `georeplications` set.
Container registries are geo-replicated to align with multi-region container deployments.
What this control checks
Container registries must have geo-replication enabled to pass; registries without it fail
Common pitfalls
Check needs premium sku and a replication block
Check to see the sku is set to premium with any replication block set.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.container_registry_geo_replication_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_AZURE_165.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
container_registry_geo_replication_enabled - Checkov Check:
CKV_AZURE_165 - Powerpipe Control:
azure_compliance.control.container_registry_geo_replication_enabled
Last reviewed: 2026-10-11