Back to Checks
gcp

GCP project has Artifact Registry Container Analysis API enabled

artifacts_container_analysis_enabled
Service: artifactsSeverity: medium
OfficialBuilt-inVerified
Resource Type:serviceusage.googleapis.com/Service

Evaluates whether Artifact Analysis (containeranalysis.googleapis.com) is enabled at the project level to support vulnerability scanning and metadata for container images in Artifact Registry or Container Registry.

Prowler logoProwlerprowler-provider-gcp

Risk

Absent this service, images aren't continuously scanned, leaving known CVEs unnoticed. Attackers can run vulnerable containers, gain code execution, move laterally, and exfiltrate data, eroding the integrity and confidentiality of workloads and the software supply chain.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks artifacts_container_analysis_enabled

Recommendation

Enable Artifact Analysis (containeranalysis.googleapis.com) for projects hosting container images. Integrate scan results into CI/CD policy gates, apply least privilege to findings access, and rebuild images promptly to maintain defense in depth.

Remediation

CLI

gcloud services enable containeranalysis.googleapis.com --project <PROJECT_ID>

Terraform

resource "google_project_service" "<example_resource_name>" {
  project = "<example_project_id>"
  service = "containeranalysis.googleapis.com" # Enables Artifact Analysis (Container Analysis) API to pass the check
}

Other

1In Google Cloud Console, ensure the correct project is selected
2Go to APIs & Services > Library
3Search for "Container Analysis API"
4Click the API, then click "Enable"

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.serviceusage.serviceusage_client import (
    serviceusage_client,
)


class artifacts_container_analysis_enabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for project_id in serviceusage_client.project_ids:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=serviceusage_client.projects[project_id],
                resource_id="containeranalysis.googleapis.com",
                resource_name="AR Container Analysis",
                project_id=project_id,
                location=serviceusage_client.region,
            )
            report.status = "FAIL"
            report.status_extended = (
                f"AR Container Analysis is not enabled in project {project_id}."
            )
            for active_service in serviceusage_client.active_services.get(
                project_id, []
            ):
                if active_service.name == "containeranalysis.googleapis.com":
                    report.status = "PASS"
                    report.status_extended = (
                        f"AR Container Analysis is enabled in project {project_id}."
                    )
                    break
            findings.append(report)

        return findings

References