Image Vulnerability Scanning Using Gcr Container Analysis

More Info:

Scan images being deployed to Amazon EKS for vulnerabilities.

Risk Level

Medium

Address

Security

Compliance Standards

APRA CPS 234 (Australia)
BSI C5 (Germany)
Brazil LGPD
CCPA / CPRA (California)
CIS Critical Security Controls v8
CIS GKE
CMMC 2.0
CSA Cloud Controls Matrix v4
DPDPA
Digital Operational Resilience Act (EU)
Essential 8
ISO/IEC 27017
ISO/IEC 27018
ISO/IEC 27701
KSA PDPL
MAS Technology Risk Management (Singapore)
MITRE ATT&CK (Cloud)
NIS2 Directive
NIST SP 800-171
NYDFS 23 NYCRR 500
SWIFT Customer Security Controls Framework
Sarbanes-Oxley IT General Controls
UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Manual Steps

Check if Container Scanning API is enabled (project-level)
- Run on: any machine with gcloud configured for the project.
```
gcloud services list --enabled \
  --filter="config.name:containerscanning.googleapis.com"
```
- If no service is returned, Container Scanning is not enabled.
Enable Container Scanning API if required
- Run on: any machine with gcloud configured and permissions to modify services.
```
gcloud services enable containerscanning.googleapis.com
```
- Re-run step 1 to confirm it now appears as enabled.
Verify a supported image registry/workflow is in use
- Confirm that container images for your GKE workloads are stored in Artifact Registry or Container Registry associated with this project (check your CI/CD config, image names like *.pkg.dev or gcr.io/...).
- If you use a third‑party registry (e.g., Docker Hub, ECR), note that you must rely on a third‑party scanning provider instead of, or in addition to, GCR/Artifact Registry scanning.
Review current vulnerability scan results for images
- Run on: any machine with gcloud. Adjust --repository and --location to your setup.
```
# Artifact Registry example
gcloud artifacts vulnerabilities list \
  --project=PROJECT_ID \
  --location=LOCATION \
  --repository=REPOSITORY_NAME
```
- If using Container Registry, review vulnerability data via the Cloud Console (Container Registry → Images → select image → Vulnerabilities tab).
Assess and decide on a third‑party provider (if not using GCR/Artifact Registry scanning)
- If images are in an external registry, confirm whether a scanning solution (e.g., Prisma, Aqua, Trivy in CI) is in place and integrated into your build/deploy process.
- Collect evidence: CI/CD pipeline configs, scanner reports, or security tool dashboards showing image vulnerability scans before deployment.
Record and enforce the chosen approach
- Document whether the project uses:
  - GCR/Artifact Registry scanning via containerscanning.googleapis.com, and/or
  - A third‑party scanning provider integrated into CI/CD.
- Ensure your deployment process requires images to pass vulnerability scanning before being pushed or deployed, and periodically re‑review scan reports as in step 4.

Using kubectl

kubectl cannot enable image vulnerability scanning because this setting is configured at the GCP project / cloud-provider level, not on Kubernetes API objects. Use the cloud console, gcloud CLI, or IaC as described in the Manual Steps section to enable containerscanning.googleapis.com and/or integrate a third-party scanner.

Automation

#!/usr/bin/env bash
#
# Report image vulnerability scanning posture for a GKE environment
# - Verifies Container Scanning API is enabled on the GCP project
# - Lists unique container images in the cluster
# - Shows which images have/are missing vulnerability scan results
#
# REQUIREMENTS:
# - Run on any machine with: gcloud, kubectl, jq
# - You must be authenticated to the correct GCP project and cluster

set -euo pipefail

PROJECT_ID="$(gcloud config get-value project 2>/dev/null || true)"
if [[ -z "${PROJECT_ID}" || "${PROJECT_ID}" == "(unset)" ]]; then
  echo "ERROR: No GCP project set in gcloud config. Run:"
  echo "  gcloud config set project YOUR_PROJECT_ID"
  exit 1
fi

echo "Using GCP project: ${PROJECT_ID}"
echo "Cluster context:   $(kubectl config current-context 2>/dev/null || echo 'UNKNOWN')"
echo

#############################################
# 1. Check if Container Scanning API is enabled
#############################################
echo "=== 1) Container Scanning API status (containerscanning.googleapis.com) ==="

if gcloud services list --enabled \
  --project "${PROJECT_ID}" \
  --filter="config.name:containerscanning.googleapis.com" \
  --format="value(config.name)" | grep -q '^containerscanning.googleapis.com$'; then
  echo "OK: Container Scanning API is ENABLED for project ${PROJECT_ID}"
  API_ENABLED=true
else
  echo "PROBLEM: Container Scanning API is NOT enabled for project ${PROJECT_ID}"
  echo "  This means GCR/Artifact Registry images in this project will not be"
  echo "  automatically scanned for vulnerabilities by Google Container Analysis."
  API_ENABLED=false
fi
echo

#############################################
# 2. Collect unique images used in the cluster
#############################################
echo "=== 2) Unique container images running in the cluster ==="

# This lists all images used by running Pods (including system namespaces)
# Format: IMAGE_URL
kubectl get pods --all-namespaces -o json \
  | jq -r '.items[]
    | .spec.containers[]?.image,
      .spec.initContainers[]?.image' \
  | sort -u > /tmp/cluster-images.txt

if [[ ! -s /tmp/cluster-images.txt ]]; then
  echo "No images found in running Pods. (Check that you are connected to the right cluster.)"
  exit 0
fi

echo "Found $(wc -l < /tmp/cluster-images.txt) unique images in the cluster."
echo

#############################################
# 3. Identify GCR/Artifact Registry images vs others
#############################################
echo "=== 3) Image classification (GCR/Artifact Registry vs external) ==="

echo "GCR / Artifact Registry images (eligible for Container Analysis in this project):"
grep -E '(^gcr\.io/|^[a-z0-9-]+-docker\.pkg\.dev/)' /tmp/cluster-images.txt || echo "  (none)"
echo

echo "Non-GCR/Artifact Registry images (require a third-party scanner or external process):"
grep -Ev '(^gcr\.io/|^[a-z0-9-]+-docker\.pkg\.dev/)' /tmp/cluster-images.txt || echo "  (none)"
echo

#############################################
# 4. (Optional) Check vulnerability notes for GCR/Artifact Registry images
#    using Container Analysis API
#############################################
if [[ "${API_ENABLED}" != true ]]; then
  echo "SKIP detailed vulnerability lookup because Container Scanning API is disabled."
  echo "Once enabled, re-run this script to see which images have scan results."
  exit 0
fi

echo "=== 4) Vulnerability scan presence for GCR/Artifact Registry images ==="
echo "Note: This uses Container Analysis API; it may take time on large clusters."
echo

# Function: extract image path and digest (if available) for Container Analysis
# For simplicity, we query by image URL string; this is heuristic but useful for review.
while read -r IMAGE; do
  [[ -z "${IMAGE}" ]] && continue

  if ! grep -qE '(^gcr\.io/|^[a-z0-9-]+-docker\.pkg\.dev/)' <<< "${IMAGE}"; then
    continue
  fi

  echo "Image: ${IMAGE}"

  # List related vulnerability occurrences, if any
  OCCURRENCES=$(gcloud container binauthz vulnerabilities list "${IMAGE}" \
    --project "${PROJECT_ID}" \
    --format="json" 2>/dev/null || echo "[]")

  COUNT=$(jq 'length' <<< "${OCCURRENCES}")

  if [[ "${COUNT}" -eq 0 ]]; then
    echo "  PROBLEM: No vulnerability scan occurrences found via Container Analysis."
    echo "           This may indicate the image has not been scanned yet."
  else
    echo "  OK: Found ${COUNT} vulnerability occurrence(s) via Container Analysis."
  fi

  echo
done < /tmp/cluster-images.txt

#############################################
# HOW TO INTERPRET OUTPUT
#############################################
cat <<'EOF'
INTERPRETATION (what indicates a problem):

1) "PROBLEM: Container Scanning API is NOT enabled"
   - The GCP project is not configured to perform automatic image vulnerability
     scanning via Container Analysis for GCR/Artifact Registry images.

2) "Non-GCR/Artifact Registry images (require a third-party scanner or external process)"
   - Any images listed here MUST be covered by some other vulnerability scanning
     solution (e.g., CI pipeline scanner, registry-native scanner). If they are not
     scanned elsewhere, this is a gap.

3) For GCR/Artifact Registry images:
   - "PROBLEM: No vulnerability scan occurrences found via Container Analysis."
     for an image means Container Analysis has no vulnerability data recorded.
     This suggests:
       * the image is very new and scanning hasn't completed yet, or
       * the image is not being scanned (misconfiguration), or
       * the image comes from a project/registry not covered by scanning.

Use this report to review:
- Whether the API is enabled on the right GCP projects.
- Whether all in-cluster images are covered by either Container Analysis or a
  documented third-party vulnerability scanning process.
EOF

Additional Reading:

https://docs.aws.amazon.com/AmazonECR/latest/userguide/image-scanning.html

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​

Additional Reading:​