> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Image Vulnerability Scanning Is Performed

### More Info:

Scan images stored in Google Container Registry (GCR) for vulnerabilities.

### Risk Level

Medium

### Address

Security, Reliability, Best Practice

### Compliance Standards

HITRUST, SOC2, NISTCSF, PCIDSS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Ensure Image Vulnerability Scanning Is Performed" for GCP using GCP console, please follow the below steps:

        1. Open the Google Cloud Console and navigate to the Google Container Registry page.

        2. Select the project that contains the image that you want to scan.

        3. In the left-hand menu, select "Container Registry" under "Tools".

        4. Click on the "Vulnerability scanning" tab.

        5. If vulnerability scanning is not enabled, click on the "Enable scanning" button.

        6. Choose the severity level for the vulnerabilities that you want to be notified about.

        7. Click on the "Save" button to enable vulnerability scanning.

        8. Once vulnerability scanning is enabled, you can view the scan results for all the images in your project.

        9. If any vulnerabilities are detected, you can take appropriate actions to remediate them.

        By following these steps, you can ensure that image vulnerability scanning is performed in GCP, and you can remediate any vulnerabilities that are detected.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration of not having image vulnerability scanning enabled in GCP using GCP CLI, you can follow the below steps:

        1. Open the Cloud Shell in your GCP console.

        2. Run the following command to enable the Container Analysis API:

        ```
        gcloud services enable containeranalysis.googleapis.com
        ```

        3. Run the following command to create a new vulnerability scan for a specific image:

        ```
        gcloud container images describe [IMAGE_NAME] --format='get(vulnerabilityReport)'
        ```

        Note: Replace \[IMAGE\_NAME] with the name of the image you want to scan.

        4. Run the following command to get a list of images that have vulnerability scanning enabled:

        ```
        gcloud container images list --filter='vulnerabilityReport != null'
        ```

        This will return a list of all the images that have vulnerability scanning enabled.

        5. Run the following command to enable vulnerability scanning for all images in a specific project:

        ```
        gcloud projects set-iam-policy [PROJECT_ID] \
        --member=serviceAccount:service-[PROJECT_NUMBER]@container-analysis.iam.gserviceaccount.com \
        --role=roles/containeranalysis.occurrenceViewer
        ```

        Note: Replace \[PROJECT\_ID] with the ID of the project you want to enable vulnerability scanning for, and \[PROJECT\_NUMBER] with the number of the project.

        6. Finally, run the following command to verify that vulnerability scanning is enabled for all images in the project:

        ```
        gcloud container images list --project=[PROJECT_ID] --filter='vulnerabilityReport != null'
        ```

        This will return a list of all the images in the project that have vulnerability scanning enabled.

        By following these steps, you can remediate the misconfiguration of not having image vulnerability scanning enabled in GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Ensure Image Vulnerability Scanning Is Performed" in GCP, you can follow the below steps using Python:

        1. Install the Google Cloud Client Library for Python using the below command:

        ```python theme={null}
        pip install google-cloud-storage
        ```

        2. Create a new project in GCP and enable the Container Analysis API.

        3. Create a service account and download the JSON key.

        4. Set the environment variable for the service account key:

        ```python theme={null}
        export GOOGLE_APPLICATION_CREDENTIALS="[PATH]"
        ```

        5. Use the below Python code to enable the Container Analysis API for all images in the project:

        ```python theme={null}
        from google.cloud import containeranalysis_v1
        from google.cloud.containeranalysis_v1.proto import grafeas_pb2
        from google.protobuf import json_format

        client = containeranalysis_v1.ContainerAnalysisClient()

        project_id = 'YOUR_PROJECT_ID'

        parent = client.project_path(project_id)

        for image in client.list_note_occurrences(parent):
            note_name = image.note_name
            occ_name = image.name
            occ = client.get_occurrence(occ_name)
            if not occ.vulnerability:
                continue
            vulnerability = occ.vulnerability
            if vulnerability.effective_severity == grafeas_pb2.Severity.SEVERITY_UNSPECIFIED:
                continue
            print(f'Image {note_name} has vulnerability {vulnerability.effective_severity.name}')
        ```

        6. This code will list all the images with vulnerabilities in the specified project.

        7. You can use the above code as a starting point to build your own tool to scan images for vulnerabilities and ensure that image vulnerability scanning is performed.

        8. You can also set up a continuous integration and delivery (CI/CD) pipeline to automatically scan images for vulnerabilities before deploying them to production.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/container-registry/docs/container-analysis](https://cloud.google.com/container-registry/docs/container-analysis)