Enable and use Artifact Registry vulnerability assessment

Enterprise (Deprecated) service tier

The Security Command Center Enterprise service tier will shut down on May 21, 2027. If your organization uses the Enterprise service tier, then the organization will automatically move to the Premium service tier on or after May 21, 2027. Contact your account representative or a Google Cloud sales specialist if you have questions.

Artifact Registry vulnerability assessment is a detection service that alerts you to vulnerabilities in your deployed container images.

This detection service generates vulnerability findings for container images under the following conditions:

• The container image is stored in Artifact Registry.

• The container image is deployed to one of the following assets:

  • Google Kubernetes Engine cluster
  • Cloud Run service
  • Cloud Run job
  • App Engine

Artifact Registry vulnerability assessment creates findings for vulnerabilities that are classified as HIGH or CRITICAL severity. Artifact Registry vulnerability assessment won't generate findings for vulnerabilities that have a lower severity.

If your container images have MEDIUM or LOW severity vulnerabilities, you can manage them in the Artifact Registry vulnerability assessment, but Security Command Center doesn't display them.

Finding lifecycle

Artifact Registry vulnerability assessment only scans images that were pulled in the last 30 days. It continues to scan the image and create or update findings until the image hasn't been pulled for more than 30 days.

After Artifact Registry vulnerability assessment findings are created, they remain available for you to query up to 30 days after the last finding update. Security Command Center keeps Artifact Registry vulnerability assessment findings in the ACTIVE state for 30 days after the last update.

If the asset related to the finding is deleted within 3 days of the last update time, Artifact Registry vulnerability assessment changes the finding state to INACTIVE. If the asset is deleted more than 3 days after the last scan, the finding remains ACTIVE for 7 days, after which the state changes to INACTIVE.

Security Command Center deletes Artifact Registry vulnerability assessment findings 7 days after they are deactivated.

For more information about Security Command Center data retention, see Data retention.

Enable Artifact Registry vulnerability assessment

For Artifact Registry vulnerability assessment to generate findings in Security Command Center for deployed container images stored in Artifact Registry, the Container Scanning API must be enabled for your project and Security Command Center must be activated at the organization level.

If you haven't enabled the Container Scanning API, do the following:

1. In the Google Cloud console, go to the Container Scanning API page.

   Go to Container Scanning API

2. Select the project you want to enable the Container Scanning API for.

3. Click Enable.

Security Command Center displays findings for scanned vulnerable container images that are actively deployed to supported runtime assets. However, the detection service behaves differently depending on when you enabled Security Command Center and when you enabled the Container Scanning API.

Enablement scenario	Detection service behavior
You enabled Security Command Center after you enabled the Container Scanning API and deployed a container image.	Artifact Registry vulnerability assessment generates findings for existing vulnerabilities found with previous Artifact Registry scans within 24 hours of enablement.
You enabled Security Command Center and deployed a container image before you enabled the Container Scanning API.	Artifact Registry vulnerability assessment doesn't automatically generate vulnerability findings for container images you deployed before enabling the API until a new scan is triggered. To manually trigger a new scan, redeploy the container image to the same runtime resource. Artifact Registry vulnerability assessment immediately generates findings if any vulnerabilities are detected during the scan.
You enabled Security Command Center and the Container Scanning API before you deployed a container image.	The newly deployed container image is immediately scanned in Artifact Registry and Artifact Registry vulnerability assessment generates findings if any vulnerabilities are detected by the scan.

Disable Artifact Registry vulnerability assessment

To disable Artifact Registry vulnerability assessment, do the following:

1. In the Google Cloud console, go to the API/Service Details page for the Container Scanning API.

   Go to API/Service Details

2. Select the project you want to disable the Container Scanning API for.

3. Click Disable API.

Security Command Center doesn't display findings for vulnerabilities detected in future container image scans.

You can also disable Artifact Registry vulnerability assessment by disabling the Vulnerability Assessment source ID in the Security Command Center settings. However, we don't recommend this. Disabling the Vulnerability Assessment source ID will disable all the detection services classified under the Vulnerability Assessment source ID. Therefore, we recommend disabling the Container Scanning API with the preceding procedure.

Artifact Registry vulnerability assessment detectors

Detector

Summary

Container image vulnerability Category name in the API: CONTAINER_IMAGE_VULNERABILITY

Finding description: A vulnerability was detected in a container image that was scanned in Artifact Registry. This image is deployed to one of the following assets: Google Kubernetes Engine cluster Cloud Run service Cloud Run job App Engine Pricing tier: Standard, Premium, or Enterprise Fix this finding : Depending on the resource type, do the following: For Cloud Run jobs or executions, update the job configuration with a fixed image version. The finding is resolved if the Cloud Run job with the vulnerable image version isn't executed for 12 hours. For Cloud Run services or revisions, allocate traffic to a different revision that is deployed with a fixed image version. Make sure that traffic is not allocated to the revision with the vulnerable image. For Google Kubernetes Engine or App Engine assets, upgrade or delete the container image version. You can resolve the finding by either removing the runtime association or removing the vulnerable image version in Artifact Registry. Refer to the details of the finding for specific remediation steps based on the appropriate runtime resource. For Standard-legacy tier customers, using the Asset query feature of Cloud Asset Inventory to determine where the vulnerable container image is deployed is not supported. We recommend upgrading to the Premium or Enterprise tiers to get more detailed information.

View Artifact Registry vulnerability assessment findings in the console

1. In the Google Cloud console, go to the Findings page of Security Command Center.

   Go to Findings

2. Select your Google Cloud project or organization.
3. In the Quick filters section, in the Source display name subsection, select Vulnerability Assessment. The findings query results are updated to show only the findings from this source.
4. To view the details of a specific finding, click the finding name in the Category column. The details panel for the finding opens and displays the Summary tab.
5. On the Summary tab, review the details of the finding, including information about what was detected, the affected resource, and—if available—steps that you can take to remediate the finding.
6. Optional: To view the full JSON definition of the finding, click the JSON tab.