documentor

Author: ElazarK

articles/defender-for-cloud/gated-deployment-infrastructure-as-code.md

@@ -10,7 +10,7 @@ ms.topic: how-to
 
 # Gated deployment for Infrastructure as Code
 
-Microsoft Defender for Cloud's gated deployment agent is a Kubernetes admission controller that enforces container image security policies at deployment time. Gated deployment acts a gatekeeper for container images for known security issues at deployment time and decides whether they’re allowed to run.
+Microsoft Defender for Cloud's gated deployment agent is a Kubernetes admission controller that enforces container image security policies at deployment time. Gated deployment acts as a gatekeeper for container images for known security problems at deployment time and decides whether they're allowed to run.
 
 The gated deployment agent requires read access to all of your Azure Container Registries (ACRs) associated with the cluster. These registries store the container images alongside the vulnerability assessment artifacts generated by Defender for Containers. To enable this access, configure a Managed Service Identity (MSI) with the required ACR read permissions and assign it to the agent.
 
@@ -22,11 +22,11 @@ The gated deployment agent requires read access to all of your Azure Container R
 
 ## Deploy the gated agent
 
-1. [Create a Managed Service Identity (MSI) that the gated deployment agent uses.](/entra/identity/managed-identities-azure-resources/manage-user-assigned-managed-identities-azure-portal).
+1. [Create a Managed Service Identity (MSI) that the gated deployment agent uses](/entra/identity/managed-identities-azure-resources/manage-user-assigned-managed-identities-azure-portal).
 
-1. [Assign the AcrPull role (or equivalent read role)](/azure/container-registry/container-registry-rbac-built-in-roles-overview?tabs=registries-configured-with-rbac-registry-abac-repository-permissions) to the MSI on all ACRs used by the cluster.
+1. [Assign the AcrPull role (or equivalent read role)](/azure/container-registry/container-registry-rbac-built-in-roles-overview?tabs=registries-configured-with-rbac-registry-abac-repository-permissions) to the MSI on all ACRs the cluster uses.
 
-1. [Add a Federated Identity Credential (FIC) to the MSI](/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-1.0) that allows the gated deployment agent to authenticate using AKS Workload Identity, with the following FIC parameters:
+1. [Add a Federated Identity Credential (FIC) to the MSI](/graph/api/resources/federatedidentitycredentials-overview?view=graph-rest-1.0) that allows the gated deployment agent to authenticate by using AKS Workload Identity, with the following FIC parameters:
 
     - **Issuer**: The AKS OIDC issuer URL
     - **Subject**: The service account used by the gated deployment agent `system:serviceaccount:kube-system:defender-admission-controller-serviceaccount`.