Back to Checks
gcp

Project has GCR Container Scanning API enabled

gcr_container_scanning_enabled
Service: gcrSeverity: medium
OfficialBuilt-inVerified
Categories:vulnerabilitiescontainer-security
Resource Type:serviceusage.googleapis.com/Service

Google Cloud projects with containerscanning.googleapis.com enabled perform automatic vulnerability scanning for images in Container Registry and Artifact Registry.

The finding indicates whether that service is active to generate and refresh vulnerability metadata for your container images.

Prowler logoProwlerprowler-provider-gcp

Risk

Without image scanning, vulnerable packages can reach production unchecked, enabling:

  • Remote code execution or privilege escalation (integrity/availability)
  • Data exfiltration from compromised workloads (confidentiality)
  • Supply chain compromise via unvetted base images

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks gcr_container_scanning_enabled

Recommendation

Enable containerscanning.googleapis.com and integrate results into CI/CD gates. Apply defense in depth:

  • Use Binary Authorization to block noncompliant images
  • Enforce least privilege over who can disable scanning
  • Rebuild and patch frequently; prefer trusted, signed base images

Remediation

CLI

gcloud services enable containerscanning.googleapis.com

Terraform

resource "google_project_service" "<example_resource_name>" {
  project = "<example_project_id>"
  service = "containerscanning.googleapis.com" # Critical: enables Container Scanning API to pass the check
}

Other

1In the Google Cloud console, go to APIs & Services > Library
2Search for "Container Scanning API"
3Click the result and then click "Enable"

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.serviceusage.serviceusage_client import (
    serviceusage_client,
)


class gcr_container_scanning_enabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for project_id in serviceusage_client.project_ids:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=serviceusage_client.projects[project_id],
                resource_id="containerscanning.googleapis.com",
                resource_name="GCR Container Scanning",
                project_id=project_id,
                location=serviceusage_client.region,
            )
            report.status = "FAIL"
            report.status_extended = (
                f"GCR Container Scanning is not enabled in project {project_id}."
            )
            for active_service in serviceusage_client.active_services.get(
                project_id, []
            ):
                if active_service.name == "containerscanning.googleapis.com":
                    report.status = "PASS"
                    report.status_extended = (
                        f"GCR Container Scanning is enabled in project {project_id}."
                    )
                    break
            findings.append(report)

        return findings

References