More Info:
Scan images stored in Google Container Registry (GCR) for vulnerabilities.Risk Level
MediumAddress
Security, Reliability, Best PracticeCompliance Standards
HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Ensure Image Vulnerability Scanning Is Performed” for GCP using GCP console, please follow the below steps:
- Open the Google Cloud Console and navigate to the Google Container Registry page.
- Select the project that contains the image that you want to scan.
- In the left-hand menu, select “Container Registry” under “Tools”.
- Click on the “Vulnerability scanning” tab.
- If vulnerability scanning is not enabled, click on the “Enable scanning” button.
- Choose the severity level for the vulnerabilities that you want to be notified about.
- Click on the “Save” button to enable vulnerability scanning.
- Once vulnerability scanning is enabled, you can view the scan results for all the images in your project.
- If any vulnerabilities are detected, you can take appropriate actions to remediate them.
Using CLI
Using CLI
To remediate the misconfiguration of not having image vulnerability scanning enabled in GCP using GCP CLI, you can follow the below steps:Note: Replace [IMAGE_NAME] with the name of the image you want to scan.This will return a list of all the images that have vulnerability scanning enabled.Note: Replace [PROJECT_ID] with the ID of the project you want to enable vulnerability scanning for, and [PROJECT_NUMBER] with the number of the project.This will return a list of all the images in the project that have vulnerability scanning enabled.By following these steps, you can remediate the misconfiguration of not having image vulnerability scanning enabled in GCP using GCP CLI.
- Open the Cloud Shell in your GCP console.
- Run the following command to enable the Container Analysis API:
- Run the following command to create a new vulnerability scan for a specific image:
- Run the following command to get a list of images that have vulnerability scanning enabled:
- Run the following command to enable vulnerability scanning for all images in a specific project:
- Finally, run the following command to verify that vulnerability scanning is enabled for all images in the project:
Using Python
Using Python
To remediate the misconfiguration “Ensure Image Vulnerability Scanning Is Performed” in GCP, you can follow the below steps using Python:
- Install the Google Cloud Client Library for Python using the below command:
- Create a new project in GCP and enable the Container Analysis API.
- Create a service account and download the JSON key.
- Set the environment variable for the service account key:
- Use the below Python code to enable the Container Analysis API for all images in the project:
- This code will list all the images with vulnerabilities in the specified project.
- You can use the above code as a starting point to build your own tool to scan images for vulnerabilities and ensure that image vulnerability scanning is performed.
- You can also set up a continuous integration and delivery (CI/CD) pipeline to automatically scan images for vulnerabilities before deploying them to production.