If you choose to enable the automatic vulnerability scanning feature for your container images, the price is $0.26 per scanned container image.
There is a different cost per scan for Security Command Center customers based on the service tier. For more information about Security Command Center service tier costs, see the Security Command Center pricing page.
Note: Security Command Center customers will not see the standard “Container Registry vulnerability scan” line item on their bill. Security Command Center PayGo customers will see an Security Command Center Registry scan sku and Security Command Center subscription customers will not see a charge for registry scanning, as it’s part of their subscription charge.
- When you enable the Container Scanning API, billing begins immediately.
- Artifact Analysis automatically scans an image the first time you push it to the registry and charges you for the initial scan. This charge applies only to the initial scan and is not affected by the number of layers on the base image. Once the image has been uploaded and initially scanned, subsequent scans of the same image are free. Each image is uniquely identified by a digest. Images with the same digest are considered the same image.
- Artifact Analysis does not automatically scan existing images after you enable the API. To scan an existing image, you must push it again.
Each new version of an image is associated with a digest, a unique identifier that is created when you push the image to Artifact Analysis. Tags that you add to an image are labels and do not change the content of the image, therefore you are not billed for adding or editing tags.
Automatic vulnerability scanning is also available for software packages outside of containers. The primary differences between scanning packages that aren't part of a container and scanning container images are:
- There is no deduplication; if the same non container package is pushed to multiple repositories, then customers will be charged for each scan.
- When scanning is enabled in Artifact Analysis, package scanning isn't enabled by default when a new package-based repository is created. Instead, you must enable scanning on each individual package-based repository in a project. This configuration differs from container scanning, which is enabled by default on new container-based repositories.
