Container Registry uses a private endpoint (Private Link)

resource "azurerm_private_endpoint" "<example_resource_name>" {
  name                = "<example_resource_name>"
  location            = "<location>"
  resource_group_name = "<example_resource_name>"
  subnet_id           = "<example_subnet_id>"

  private_service_connection {
    name                           = "<example_resource_name>"
    private_connection_resource_id = "<example_resource_id>" # Critical: ACR resource ID
    subresource_names              = ["registry"]            # Critical: Target 'registry' subresource to enable Private Link
  }
}

// Create a Private Endpoint to ACR
resource privateEndpoint 'Microsoft.Network/privateEndpoints@2025-05-01' = {
  name: '<example_resource_name>'
  location: resourceGroup().location
  properties: {
    subnet: {
      id: '<example_subnet_id>'
    }
    privateLinkServiceConnections: [
      {
        name: '<example_resource_name>'
        properties: {
          privateLinkServiceId: '<example_resource_id>' // Critical: ACR resource ID to connect
          groupIds: ['registry']                        // Critical: Target the 'registry' subresource to enable Private Link
        }
      }
    ]
  }
}