Check ID:
Provider: GCP
Service:
Severity: MEDIUM
Categories:
Resource type:
gcr_container_scanning_enabledProvider: GCP
Service:
gcrSeverity: MEDIUM
Categories:
vulnerabilities, container-securityResource type:
serviceusage.googleapis.com/ServiceWhat this check verifies
Google Cloud projects withcontainerscanning.googleapis.com enabled perform automatic vulnerability scanning for images in Container Registry and Artifact Registry.
The finding indicates whether that service is active to generate and refresh vulnerability metadata for your container images.
Risk
Without image scanning, vulnerable packages can reach production unchecked, enabling:- Remote code execution or privilege escalation (integrity/availability)
- Data exfiltration from compromised workloads (confidentiality)
- Supply chain compromise via unvetted base images
Recommendation
Enablecontainerscanning.googleapis.com and integrate results into CI/CD gates. Apply defense in depth:
- Use Binary Authorization to block noncompliant images
- Enforce least privilege over who can disable scanning
- Rebuild and patch frequently; prefer trusted, signed base images
Remediation
- CLI
- Terraform
- Dashboard steps
gcloud services enable containerscanning.googleapis.com
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/ArtifactRegistry/enable-vulnerability-analysis.html
- https://cloud.google.com/container-registry/docs/container-analysis
- https://docs.cloud.google.com/artifact-analysis/docs/enable-automatic-scanning
- https://cloud.google.com/container-registry/docs/container-best-practices
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = gcr_container_scanning_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks