Vulnerability Scanner

Step 1: Enable Required APIs
gcloud services enable \
  securitycenter.googleapis.com \
  containeranalysis.googleapis.com \
  artifactregistry.googleapis.com
Step 2: Enable Security Command Center (SCC)

SCC gives you a central dashboard for findings like vulnerabilities, misconfigs, and threats.

gcloud scc settings update --organization=YOUR_ORG_ID \
  --enable-new-services

You must be in an organization, not just a project.

You can now see security findings in the Security Command Center in the Cloud Console.

Step 3: Scan Container Images

GCP can automatically scan container images pushed to Artifact Registry or Container Registry.

  • Push a container image:
    • gcloud builds submit --tag=LOCATION-docker.pkg.dev/PROJECT_ID/REPO/IMAGE_NAME
  • View scan results:

    • Go to Security > Container Analysis > Vulnerabilities in the Console.

    Or with CLI:

    gcloud artifacts docker images list LOCATION-docker.pkg.dev/PROJECT_ID/REPO
gcloud artifacts docker images describe LOCATION-docker.pkg.dev/PROJECT_ID/REPO/IMAGE_NAME
    Step 4: Automate Alerting

    Set up Pub/Sub notifications for vulnerability findings.

    • Create a topic:
      • gcloud pubsub topics create vuln-alerts
    • Create a subscription:
      • gcloud pubsub subscriptions create vuln-sub \
  --topic=vuln-alerts
    • Connect it in the SCC → Settings → Notifications.