Skip to main content

Ensure Image Vulnerability Scanning Is Enabled

More Info:​

Enable vulnerability scanning on images stored in GCR or Artifact Registry so known CVEs in container images are surfaced. Scanning helps prevent deploying images with exploitable vulnerabilities.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS GKE

Triage and Remediation​

Remediation​

Manual Steps

  1. On any machine with gcloud configured to the target project, enable Container Analysis API (for GCR images):

    gcloud services enable containeranalysis.googleapis.com

  2. On the same machine, enable Container Scanning API (for Artifact Registry images):

    gcloud services enable containerscanning.googleapis.com

  3. (Optional console check for GCR) In a browser, open:

  4. (Optional console check for Artifact Registry) In a browser, open:

  5. Verify that vulnerability scanning is enabled via API on the same machine with gcloud:

    gcloud services list --enabled | grep containerscanning.googleapis.com && echo "enabled" || echo "disabled"
Using kubectl

kubectl cannot enable image vulnerability scanning because this setting is configured at the Google Cloud project level (GCR/Artifact Registry APIs), not on Kubernetes API objects. To remediate this finding, make the changes in the Google Cloud Console or via gcloud as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# Enable image vulnerability scanning for:
# - Google Container Registry (GCR): containeranalysis.googleapis.com
# - Artifact Registry (AR): containerscanning.googleapis.com
#
# Run this on any machine with:
# - gcloud installed
# - authenticated to the target GCP project
# - correct IAM permissions to enable services
#
# Usage:
#   PROJECT_ID=your-project-id ./enable_image_scanning.sh
# or:
#   ./enable_image_scanning.sh your-project-id
#

set -euo pipefail

PROJECT_ID="${PROJECT_ID:-${1:-}}"

if [[ -z "${PROJECT_ID}" ]]; then
  echo "ERROR: PROJECT_ID not set and no project ID argument provided."
  echo "Usage: PROJECT_ID=your-project-id $0"
  echo "   or: $0 your-project-id"
  exit 1
fi

echo "Using project: ${PROJECT_ID}"
gcloud config set project "${PROJECT_ID}" >/dev/null

enable_service_if_needed() {
  local service="$1"

  if gcloud services list --enabled --format="value(config.name)" \
      --filter="config.name=${service}" | grep -qx "${service}"; then
    echo "Service already enabled: ${service}"
  else
    echo "Enabling service: ${service}"
    gcloud services enable "${service}"
    echo "Enabled service: ${service}"
  fi
}

echo "Ensuring vulnerability scanning services are enabled..."

# For images hosted in GCR
enable_service_if_needed "containeranalysis.googleapis.com"

# For images hosted in Artifact Registry
enable_service_if_needed "containerscanning.googleapis.com"

echo "Verifying configuration..."

echo -n "containerscanning.googleapis.com (Artifact Registry scanning): "
if gcloud services list --enabled --format="value(config.name)" \
    --filter="config.name=containerscanning.googleapis.com" | \
    grep -qx "containerscanning.googleapis.com"; then
  echo "enabled"
else
  echo "disabled (verification failed)"
  exit 1
fi

echo -n "containeranalysis.googleapis.com (GCR vulnerability scanning backend): "
if gcloud services list --enabled --format="value(config.name)" \
    --filter="config.name=containeranalysis.googleapis.com" | \
    grep -qx "containeranalysis.googleapis.com"; then
  echo "enabled"
else
  echo "disabled (verification failed)"
  exit 1
fi

echo "All required vulnerability scanning services are enabled."