Artifact Analysis provides automated vulnerability scanning for images in both Container Registry and Artifact Registry through the Container Scanning API.
See the Pricing page for pricing information.
Enabling the Container Scanning API
Artifact Analysis does not automatically scan existing images. To scan an existing image, you must push it again.
Enabling the automated container scanning API also enables the Artifact Analysis API. You can enable the API for an existing project, or create a new project and then enable the API.
Enable the Container Scanning API
Disabling the Container Scanning API
To disable vulnerability scanning for both Container Registry and Artifact Registry, do the following:
Console
Open the Settings page for either service in the Google Cloud console.
Artifact Registry:
Container Registry:
Click Disable Vulnerability Scanning.
gcloud
Run the following command:
gcloud services disable containerscanning.googleapis.com
Extending your monitoring time window
Artifact Analysis continuously monitors the vulnerability metadata for scanned images in Container Registry and Artifact Registry. The default time window for continuous monitoring is 30 days, after this period your images are stale and the metadata is no longer updated.
To extend the monitoring window, you must pull or push the image within the 30-day period. We recommend creating a scheduled task to re-push containers that don't require frequent updating, for example, your Istio and proxy images.