Project has the Container Analysis API enabled

Check ID: artifacts_container_analysis_enabled
Provider: GCP
Service: artifacts
Severity: MEDIUM
Resource type: serviceusage.googleapis.com/Service

What this check verifies

Evaluates whether Artifact Analysis (containeranalysis.googleapis.com) is enabled at the project level to support vulnerability scanning and metadata for container images in Artifact Registry or Container Registry.

Risk

Absent this service, images aren’t continuously scanned, leaving known CVEs unnoticed. Attackers can run vulnerable containers, gain code execution, move laterally, and exfiltrate data, eroding the integrity and confidentiality of workloads and the software supply chain.

Recommendation

Enable Artifact Analysis (containeranalysis.googleapis.com) for projects hosting container images. Integrate scan results into CI/CD policy gates, apply least privilege to findings access, and rebuild images promptly to maintain defense in depth.

Remediation

CLI
Terraform
Dashboard steps

gcloud services enable containeranalysis.googleapis.com —project <PROJECT_ID>

resource "google_project_service" "<example_resource_name>" {
  project = "<example_project_id>"
  service = "containeranalysis.googleapis.com" # Enables Artifact Analysis (Container Analysis) API to pass the check
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = artifacts_container_analysis_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

API key was created within the last 90 days BigQuery dataset uses a customer-managed key

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires