> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Image Vulnerability Scanning Is Enabled

### More Info:

Enable vulnerability scanning on images stored in GCR or Artifact Registry so known CVEs in container images are surfaced. Scanning helps prevent deploying images with exploitable vulnerabilities.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS GKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On any machine with `gcloud` configured to the target project, enable Container Analysis API (for GCR images):
           ```bash theme={null}
           gcloud services enable containeranalysis.googleapis.com
           ```

        2. On the same machine, enable Container Scanning API (for Artifact Registry images):
           ```bash theme={null}
           gcloud services enable containerscanning.googleapis.com
           ```

        3. (Optional console check for GCR) In a browser, open:
           * [https://console.cloud.google.com/gcr](https://console.cloud.google.com/gcr)
           * Go to **Settings** and confirm **Vulnerability Scanning** is shown as **ON**.

        4. (Optional console check for Artifact Registry) In a browser, open:
           * [https://console.cloud.google.com/artifacts](https://console.cloud.google.com/artifacts)
           * Go to **Settings** and confirm **Vulnerability Scanning** is **ENABLED**.

        5. Verify that vulnerability scanning is enabled via API on the same machine with `gcloud`:
           ```bash theme={null}
           gcloud services list --enabled | grep containerscanning.googleapis.com && echo "enabled" || echo "disabled"
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot enable image vulnerability scanning because this setting is configured at the Google Cloud project level (GCR/Artifact Registry APIs), not on Kubernetes API objects. To remediate this finding, make the changes in the Google Cloud Console or via `gcloud` as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Enable image vulnerability scanning for:
        # - Google Container Registry (GCR): containeranalysis.googleapis.com
        # - Artifact Registry (AR): containerscanning.googleapis.com
        #
        # Run this on any machine with:
        # - gcloud installed
        # - authenticated to the target GCP project
        # - correct IAM permissions to enable services
        #
        # Usage:
        #   PROJECT_ID=your-project-id ./enable_image_scanning.sh
        # or:
        #   ./enable_image_scanning.sh your-project-id
        #

        set -euo pipefail

        PROJECT_ID="${PROJECT_ID:-${1:-}}"

        if [[ -z "${PROJECT_ID}" ]]; then
          echo "ERROR: PROJECT_ID not set and no project ID argument provided."
          echo "Usage: PROJECT_ID=your-project-id $0"
          echo "   or: $0 your-project-id"
          exit 1
        fi

        echo "Using project: ${PROJECT_ID}"
        gcloud config set project "${PROJECT_ID}" >/dev/null

        enable_service_if_needed() {
          local service="$1"

          if gcloud services list --enabled --format="value(config.name)" \
              --filter="config.name=${service}" | grep -qx "${service}"; then
            echo "Service already enabled: ${service}"
          else
            echo "Enabling service: ${service}"
            gcloud services enable "${service}"
            echo "Enabled service: ${service}"
          fi
        }

        echo "Ensuring vulnerability scanning services are enabled..."

        # For images hosted in GCR
        enable_service_if_needed "containeranalysis.googleapis.com"

        # For images hosted in Artifact Registry
        enable_service_if_needed "containerscanning.googleapis.com"

        echo "Verifying configuration..."

        echo -n "containerscanning.googleapis.com (Artifact Registry scanning): "
        if gcloud services list --enabled --format="value(config.name)" \
            --filter="config.name=containerscanning.googleapis.com" | \
            grep -qx "containerscanning.googleapis.com"; then
          echo "enabled"
        else
          echo "disabled (verification failed)"
          exit 1
        fi

        echo -n "containeranalysis.googleapis.com (GCR vulnerability scanning backend): "
        if gcloud services list --enabled --format="value(config.name)" \
            --filter="config.name=containeranalysis.googleapis.com" | \
            grep -qx "containeranalysis.googleapis.com"; then
          echo "enabled"
        else
          echo "disabled (verification failed)"
          exit 1
        fi

        echo "All required vulnerability scanning services are enabled."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>