Detections
Analytics
5.1.1 Enable Artifact Analysis scanning for Artifact Registry container images
Information
Enable Artifact Analysis vulnerability scanning for container images stored in Artifact Registry and used by GKE Autopilot workloads. This verifies that container images are scanned at the registry layer before deployment to identify known vulnerabilities in image packages, dependencies, and software components. For GKE clusters, this should be treated as an Artifact Registry and Artifact Analysis control, not as a cluster level workload vulnerability scanning setting, because GKE security posture dashboard vulnerability scanning capabilities are being removed.Container images can include vulnerable operating system packages, language packages, dependencies, or other software components that increase the risk of compromise when deployed to GKE workloads. Artifact Analysis scans container images in Artifact Registry through the Container Scanning API and records vulnerability metadata through the Container Analysis API, giving platform and application teams visibility into known vulnerabilities before images are promoted or deployed.
Automatic scanning evaluates new images when they are pushed to Artifact Registry and continuously monitors scanned image metadata for newly disclosed vulnerabilities. Scans are based on image digest, so retagging an image does not trigger a new scan, and findings are limited to packages that are publicly monitored for security vulnerabilities.
Solution
Enable Artifact Analysis automatic vulnerability scanning for container images stored in Artifact Registry and used by GKE Autopilot workloads. Enabling the Container Scanning API activates automatic scanning for images pushed to standard and remote Docker repositories in Artifact Registry, and it also enables the Container Analysis API for vulnerability metadata storage and retrieval.Enable the required project APIs:
gcloud services enable artifactregistry.googleapis.com containerscanning.googleapis.com \\
--project=$PROJECT_ID
If scanning was disabled on a specific Artifact Registry repository, update the repository to allow vulnerability scanning:
gcloud artifacts repositories update $REPOSITORY \\
--project=$PROJECT_ID \\
--location=$LOCATION \\
--allow-vulnerability-scanning
Note: Repeat the repository update command for each Docker repository that stores images deployed to GKE Autopilot workloads. Repository level scanning controls are supported in Artifact Registry, and --allow-vulnerability-scanning permits automatic vulnerability scanning for the repository.
Impact:
Although enabling Artifact Analysis scanning can increase project costs and may add additional vulnerability findings that require remediation, it improves software supply chain visibility by identifying vulnerable images earlier and supports stronger deployment controls when combined with image promotion, policy checks, or Binary Authorization.
See Also
Item Details
Category: RISK ASSESSMENT
References: 800-53|RA-5, CSCv7|3, CSCv7|3.1, CSCv7|3.2
Plugin: GCP
Control ID: 0a453f4d6bd26feb0c5d98a58f13e445c45961fcbde289d23a994816bef22c31