Enabling and disabling automated scanning

Artifact Analysis provides automated vulnerability scanning for images in both Container Registry and Artifact Registry through the Container Scanning API.

See the Pricing page for pricing information.

Enabling the Container Scanning API

Artifact Analysis does not automatically scan existing images. To scan an existing image, you must push it again.

Enabling the automated container scanning API also enables the Artifact Analysis API. You can enable the API for an existing project, or create a new project and then enable the API.

Enable the Container Scanning API

Disabling the Container Scanning API

To disable vulnerability scanning for both Container Registry and Artifact Registry, do the following:


  1. Open the Settings page for either service in the Google Cloud console.

    Artifact Registry:

    Open the Settings page

    Container Registry:

    Open the Settings page

  2. Click Disable Vulnerability Scanning.


Run the following command:

gcloud services disable containerscanning.googleapis.com

Extending your monitoring time window

Artifact Analysis continuously monitors the vulnerability metadata for scanned images in Container Registry and Artifact Registry. The default time window for continuous monitoring is 30 days, after this period your images are stale and the metadata is no longer updated.

To extend the monitoring window, you must pull or push the image within the 30-day period. We recommend creating a scheduled task to re-push containers that don't require frequent updating, for example, your Istio and proxy images.

What's next